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DOES HIPAA HELP OR HINDER PATIENT 
CARE AND PUBLIC SAFETY? 


FRIDAY, APRIL 26, 2013 

House of Representatives, 

Subcommittee on Oversight and Investigations, 

Committee on Energy and Commerce, 

Washington, DC. 

The subcommittee met, pursuant to call, at 9:02 a.m., in room 
2123 of the Rayburn House Office Building, Hon. Tim Murphy 
(chairman of the subcommittee) presiding. 

Members present: Representatives Murphy, Gingrey, Scalise, 
Harper, Olson, Gardner, Griffith, Johnson, Long, Ellmers, Cassidy, 
DeGette, Braley, Schakowsky, Butterfield, Tonko, and Green. 

Staff present: Carl Anderson, Counsel, Oversight; Mike 
Bloomquist, General Counsel; Sean Bonyun, Communications Di- 
rector; Matt Bravo, Professional Staff Member; Karen Christian, 
Chief Counsel, Oversight; Andy Duberstein, Deputy Press Sec- 
retary; Brad Grantz, Policy Coordinator, Oversight and Investiga- 
tion; Debbee Hancock, Press Secretary; Brittany Havens, Legisla- 
tive Clerk; Robert Horne, Professional Staff Member, Health; Peter 
Kielty, Deputy General Counsel; Andrew Powaleny, Deputy Press 
Secretary; Alan Slobodin, Deputy Chief Counsel, Oversight; Sam 
Specter, Counsel, Oversight; Tom Wilbur, Digital Media Advisor; 
Jean Woodrow, Director, Information Technology; Phil Barnett, 
Democratic Staff Director; Stacia Cardille, Democratic Deputy 
Chief Counsel; Brian Cohen, Democratic Staff Director, Oversight 
and Investigations, Senior Policy Advisor; Elizabeth Letter, Demo- 
cratic Assistant Press Secretary; Stephen Salsbury, Democratic 
Special Assistant; Roger Sherman, Democratic Chief Counsel; and 
Matt Siegler, Democratic Counsel. 

OPENING STATEMENT OF HON. TIM MURPHY, A REPRESENTA- 
TIVE IN CONGRESS FROM THE COMMONWEALTH OF PENN- 
SYLVANIA 

Mr. Murphy. Good morning. We are here today, the Oversight 
and Investigation Subcommittee of the Committee on Energy and 
Commerce, for a hearing entitled, “Does HIPAA Help or Hinder Pa- 
tient Care and Public Safety?” 

As there is a classified briefing as well as votes this morning, we 
are going to waive opening statements in order to get right to the 
witness testimony. We will allow members to submit their opening 
statements for the record. 

A hearing last month addressed issues raised after the Newtown 
tragedy. Some of the witnesses told the subcommittee how HIPAA 
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had hindered their ability to care and treat for loved ones. We are 
going to hear from a number of folks, government representatives, 
professionals, parents, experts, family members. It is an important 
issue. 

Members, the reason we are here is members of Congress them- 
selves are experts and knowledgeable on many of these issues, so 
we appreciate your attention to this. We are here to ask questions 
and learn the facts about HIPAA from those who are knowledge- 
able of them and remind everyone that we need to maintain deco- 
rum in the committee room. Disruptions will not be tolerated and 
people doing so will be discharged if needed. 

We also are asking members to stick closely to the time limit as 
we go through. 

Ms. DeGette. Will the Chairman yield just briefly? 

Mr. Murphy. Yes. I yield briefly. 

Ms. DeGette. The Chairman and I have agreed to put all of the 
opening statements in the record, and I think that is appropriate 
given this classified briefing which was just scheduled yesterday 
out of respect to the witnesses, many whom have come from around 
the country. The Chairman and I decided we really wanted to hear 
from the witnesses. 

I will say, Mr. Chairman, though, that this is really an important 
topic, the HIPAA issues, particularly as they relate to gun violence, 
but it is also important if we are being asked to get the U.S. mili- 
tarily or otherwise involved in Syria and this classified briefing is 
with the Secretary of State, so on behalf of everybody I want to 
apologize to the witnesses. Some of us may be coming in and out, 
but we will read the testimony, and we will make sure we know 
what is going on. 

So thank you very much, Mr. Chairman. 

Mr. Murphy. I appreciate it. I want to also let members know 
I communicated with Majority Leader Eric Cantor last evening, 
and he is having his staff working on providing a special briefing 
for any members who remain through this committee. 

You are aware that the committee is holding an investigative 
hearing. I say this to the witnesses, Mr. Rodriguez and Mr. 
Rothstein, and when doing so, we have the practice of taking testi- 
mony under oath. Do you have any objections to testifying under 
oath? 

Thank you. 

The Chair then advises you that under the rules of the House 
and the rules of the committee you are entitled to be advised by 
counsel. Do you desire to be advised by counsel during your testi- 
mony today? 

Thank you. 

In that case will you please rise and raise your right hand? I will 
swear you in. 

[Witnesses sworn.] 

Mr. Murphy. Let the record show the witnesses have answered 
in the affirmative. You are now under oath and subject to the pen- 
alties set forth in Title XVIII, Section 1001 of the United States 
Code. You may each now give a 5-minute opening statement, but 
let me introduce the witnesses for today’s hearing. 
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On the first panel we have Mr. Leon Rodriguez. Mr. Rodriquez 
is the Director of the Office for Civil Rights at the Department of 
Health and Human Services. He oversees the administrative oper- 
ations of the civil rights division. 

We also have Professor Mark Rothstein. He has a joint appoint- 
ment at the University of Louisville, School of Law, and the School 
of Medicine. He also holds a Herbert F. Boehl Chair of Law and 
Medicine and is the founding director of the Institute for Bioethics, 
Health Policy, and Law at the University of Louisville School of 
Medicine. 

Gentlemen, you may begin. Make sure your microphone is on 
and pulled close to your mouth. Thank you. You may begin. 

TESTIMONY OF LEON RODRIGUEZ, DIRECTOR, OFFICE FOR 

CIVIL RIGHTS, DEPARTMENT OF HEALTH AND HUMAN SERV- 
ICES; AND PROFESSOR MARK A. ROTHSTEIN, HERBERT F. 

BOEHL CHAIR OF LAW AND MEDICINE, DIRECTOR, INSTI- 
TUTE FOR BIOETHICS, HEALTH POLICY, AND LAW, UNIVER- 
SITY OF LOUISVILLE SCHOOL OF MEDICINE 

TESTIMONY OF LEON RODRIGUEZ 

Mr. Rodriguez. Good morning, Mr. Chairman, Ranking Member 
DeGette, and members of the subcommittee. It is an honor for me 
to be here today in my capacity as Director of the Office for Civil 
Rights at the U.S. Department of Health and Human Services, and 
I thank you for calling a hearing on this very important topic. 

As HHS’s enforcement agency for civil rights and health privacy 
rights, OCR handles enforcement, policy development, and edu- 
cation for compliance with laws in those areas. Our office plays an 
important role in ensuring that an individual’s sensitive health in- 
formation remains private and secure and that individuals are able 
to exercise important rights with respect to their health informa- 
tion. 

One of the underpinnings of HIPAA is that optimal healthcare 
depends for many patients on their trust that their health informa- 
tion remains confidential. HIPAA also ensures that health informa- 
tion can flow for important and necessary purposes such as patient 
treatment, obtaining payment for health services and protecting 
the country’s public health and safety. I have often said that 
HIPAA is meant to be a valve and not a blockage, and that it is 
above all meant to maximize the welfare and interests of 
thepatients. 

As such, I look forward to discussing the existing flexibilities 
within HIPAA. HIPAA recognizes the vital role that family mem- 
bers play in supporting patients with significant illness, both phys- 
ical and mental. I have read the family testimonies that were 
placed in the record and am heartbroken by them, and so, there- 
fore, take seriously this committee’s desire to get to the right an- 
swer on these issues. 

To directly address the concerns that underlie this hearing I will 
discuss the paths that HIPAA offers for providers to disclose infor- 
mation received during treatment to protect the health and safety 
of their patients. 
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For example, HIPAA permits personal health information to be 
used or disclosed without an individual’s authorization for health 
treatment and payment and for the business operations of covered 
entities. HIPAA also permits other uses and disclosures for certain 
public health activities, for law enforcement purposes, and to avert 
serious and imminent threats to health or safety. 

I would like to talk about disclosures to family members and 
friends of patients. This is an important area. Ordinarily if a pa- 
tient does not object to information being either shared in front of 
family members or friends or with family members or friends, 
HIPAA provides a clear avenue for disclosure in those cases. 

Additionally, if a patient is incapacitated — and when I say inca- 
pacitated, we mean for that word to be given its full ordinary 
meaning — healthcare providers may still communicate with family 
and friends of the patient if the provider determines, based on pro- 
fessional judgment, that doing so is in the best interest of the indi- 
vidual. And this is, I think, an important point to underscore. 
HIPAA is meant to revolve around the professional judgment of the 
provider as to what is in the best interest of the patient. It is not 
meant to supplant that judgment. 

And so, for example, a nurse can discuss a patient’s medical con- 
dition in front of the patient’s sister, who accompanies her to an 
appointment. If a patient is unconscious or otherwise incapacitated, 
the doctor, again, can make that judgment to share information 
with family members. 

Similarly, HIPAA recognizes that professional codes, state laws, 
and professional standards of care recognize a duty and authority 
to warn of situations where a patient may pose a danger to them- 
selves or others or may have disclosed information indicating a 
threat by another to either themselves or a third person. 

In those cases where there is a serious and imminent risk of 
harm to health or safety, HIPAA has a clearly-recognized exception 
for disclosure. And when I say an imminent risk to health or safe- 
ty, it is not simply the scenario of an individual going out to com- 
mit a violent crime, but, in fact, it covers a number of possible sce- 
narios that a healthcare provider, particularly a mental healthcare 
provider, may encounter. 

We take our obligations to educate providers and patients on 
these flexibilities seriously, and it is for this reason that we in the 
Administration took the initiative in January after the tragic 
events in Newtown to issue a letter to the Nation’s healthcare pro- 
viders clarifying these important points. 

Finally, I want to talk for just a moment about the nature in 
which we utilize our enforcement authorities. We focus primarily 
on longstanding broad-based security threats. We have never taken 
enforcement action because a provider has decided in the best in- 
terests of a patient to disclose information to a related party. 

Thank you, Mr. Chairman, thank you. Ranking Member, thank 
you, members of the committee. 

[The prepared statement of Mr. Rodriquez follows:] 
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Introduction 

Mr. Chairman and members of the Subcommittee, it is an honor for me to be here today in my 
capacity as the Director of the Office for Civil Rights (OCR) at the U.S. Department of Health 
and Human Services (HHS). As HHS's enforcement agency for civil rights and health privacy 
rights, OCR investigates complaints, conducts compliance reviews, develops policy, promulgates 
regulations, and provides technical assistance and public education to ensure understanding of 
and compliance with non-discrimination and health information privacy laws. 

OCR implements the health information privacy, security, and breach notification rules, under 
the Health Insurance Portability and Accountability Act of 1996, otherwise known as HIPAA, 
and the 2009 Health Information Technology for Economic and Clinical Health Act (HITECH). 
In doing so, our office plays an important role in ensuring that individuals’ sensitive health 
information remains private and secure, and that individuals are able to exercise important rights 
with respect to their health information. We also ensure that health information can flow for 
important and necessary purposes, such as patient treatment, obtaining payment for health care 
services, and protecting the public’s health and safety. 

I thank you for the opportunity to testify today about how the HIPAA privacy requirements 
apply to health care professionals and their interactions with patients and patients’ family 
members and friends. 1 will provide a brief overview of HIPAA, describe how it applies to 
communications between health care providers and a patient’s family and loved ones, and report 
on OCR’s efforts to ensure that health care providers are ftilly aware of their ability under 
HIPAA to share information with those closest to the patient. 

Background 

HIPAA was designed to improve the efficiency and effectiveness of the health care system by 
promoting the electronic exchange of health information for administrative and financial health 
care transactions, such as submitting claims for treatment provided, or determining insurance 
eligibility. At the same time. Congress recognized that, without proper oversight, advances in 
electronic technology could erode the privacy and security of that health information. To 
address this, HIPAA requires certain health care providers, health plans, and health care 
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clearinghouses to adopt Federal privacy and security protections. The HiPAA Privacy Rule 
requires that these persons and organizations, known as covered entities, have safeguards in 
place to ensure the privacy of individuals’ identifiable health information. The rule also sets 
forth the circumstances under which covered entities may use or disclose an individual’s health 
information, and gives individuals rights with respect to their information, including rights to 
examine and obtain a copy of their health records and to request corrections. 

HITECH, in addition to accelerating the adoption of health information technology, also 
strengthened and expanded HIPAA’s privacy and security requirements. For example, HITECH 
significantly bolstered HIPAA enforcement by extending liability for compliance with certain 
aspects of HIPAA to business associates of covered entities. HITECH also called for higher civil 
monetary penalties for HIPAA violations, and it augmented the Secretary’s ability to act on 
HIPAA violations, particularly where there has been willful neglect. On January 25, 2013, HHS 
issued a Final Rule implementing these HITECH enhancements to the HIPAA Rules. 

OCR investigates complaints from the public about potential violations of the Rules, as well as 
breach reports that HITECH requires covered entities to submit to the Secretary. OCR also may 
investigate privacy and security incidents that are reported by the media, government agencies, 
or other sources. OCR also provides technical assistance to covered entities to foster compliance 
with the HIPAA Rules, and education and outreach to make the public aware of its rights under 
HIPAA. OCR is committed to expanding and improving its technical assistance and public 
education materials and finding new and innovative ways to communicate with all who have a 
role in keeping health information private and secure. 

Public Priorities 

The HIPAA Privacy Rule carefully balances individual privacy interests with important public 
priorities with standards for when an individual’s authorization is required to use or disclose 
personal health information. To achieve this balance, HIPAA includes a series of regulatory 
permissions allowing covered entities and business associates to use or disclose personal health 
information for specified purposes, without the individual’s authorization. For example, HIPAA 
permits personal health information to be used or disclosed, without an individual’s 
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authorization, for health care treatment and payment, and for the business operations of covered 
entities. HIPAA also permits uses and disclosures of individuals’ health information that are 
required by other law, as well as for certain public health activities, for law enforcement 
purposes, and to avert serious and imminent threats to health or safety. Aside from these 
permitted disclosures, HIPAA requires disclosures in only limited circumstances - to HHS to 
ensure compliance with the Rule and to individuals to ensure they are able to access their own 
information. 

I will discuss the ways in which HIPAA allows providers to share relevant information about a 
patient’s health care with the patient’s family members, friends, or others the patient wants 
involved in his or her care. I will also point out the instances in which a mental health or other 
health care provider may alert appropriate persons when a patient presents a serious and 
imminent threat to himself or others. Finally, 1 will outline OCR’s efforts to ensure providers 
understand these important provisions. 

Disclosures to Family Members and Friends 

Recognizing the integral role that family and friends play in an individual’s health care, the 
HIPAA Privacy Rule allows routine - and often critical - communications between health care 
providers and these persons. Unless the patient objects, health care providers may communicate 
with an individual’s family members, friends, or other persons the individual has involved in his 
or her health care. If the patient is not present or is incapacitated, health care providers still may 
communicate with family and friends of the patient, if the provider determines, based on 
professional Judgment, that doing so is in the best interest of the individual. I will share a few 
real-world examples to illustrate: 

• A nurse can discuss a patient’s medical condition in front of the patient’s sister who 
accompanies the patient to an appointment; 

• A pharmacist can give an individual’s prescription to a friend whom the individual sends 
to pick up the prescription; and 

• If a patient is unconscious or otherwise is incapacitated, the doctor can share information 
with family members or friends if the doctor determines, based on professional judgment, 
that doing so would be in the patient’s best interest. 
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HIPAA also recognizes various individuals who serve as the patient’s personal representative 
and have the right to access the patient’s health care information, subject to certain limitations. 
Personal representatives generally include a parent or legal guardian of a minor child, or a legal 
guardian of an adult, who has authority to make health care decisions for the individual. 

With respect to conversations between health care providers and patients’ family members and 
friends, the HIPAA Privacy Rule respects an individual’s wishes, to the extent practical and 
appropriate. This means that a health care provider is not permitted to share personal health 
information with the family members or friends of an adult individual who tells the provider not 
to do so. Protecting this core individual right under HIPAA is central to achieving HHS’s goal of 
improving the Nation’s health by fostering the public’s trust in the health care system’s ability 
and commitment to safeguard personal health information. The ability to assure individuals that 
their personal health information will remain private is particularly critical in the area of mental 
health care, where concerns about the negative attitudes associated with mental illnesses may 
affect individuals’ willingness to seek needed treatment. 

OCR has developed a number of resources over the years to educate health care providers and 
members of the public about these provisions, including dedicated pages on our website, as well 
as downloadable guides for both providers and patients, on this issue. 

These resources are available on our website at 
httD://www.hhs.gov/ocr/orivacv/hiDaa/understanding/index.html . 

“Duty to Warn” 

As the President and my colleagues at HHS have emphasized in other venues, we know that 
most people who are violent do not have a mental disorder, and most people with a mental 
disorder are not violent. HHS’s goals are to improve the identification of mental health disorders 
and the delivery of needed mental health services. With these goals in mind, HIPAA was 
designed to provide privacy and security protections to enable those who seek health care to do 
so in confidence, consistent with professional ethical standards in the medical community. 
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In those uncommon instances in which an individual poses a serious and imminent threat to 
himself or herself, or to another person, the HIPAA Privacy Rule allows a health care provider to 
alert appropriate persons of this threat, consistent with applicable law and their ethical “duty to 
warn.” In particular, HIPAA permits a covered health care provider to share relevant 
information about a patient to a person or persons who are reasonably able to prevent or lessen 
the serious and imminent threat, consistent with applicable law and standards of ethical conduct. 
Depending on the circumstances, the alert could be directed to a law enforcement official, a 
family member of the individual, the target of the threat, and/or other persons. 

This past January, as part of HHS’s response to the tragic shooting in Newtown, Connecticut, 
and other recent events, OCR published a letter to the Nation’s health care providers 
(httD://www.hhs.gov/ocr/office/lettertonationhcp.Ddf ) to ensure that they are aware of their 
ability under HIPAA to disclose information, consistent with applicable law and their ethical 
“duty to warn,” when they believe that a patient poses a serious and imminent threat to himself 
or others. 

NICS ANPRM 

On January 16, 2013, the President issued a series of Executive Actions to reduce gun violence 
across the Nation. Those actions included a commitment to address any unnecessary legal 
barriers, particularly relating to HIPAA, that may prevent states from reporting certain 
information to the national background check system for firearm purchases. The Brady Handgun 
Violence Prevention Act of 1993, and its implementing regulations, which established the 

background check system, prohibit several categories of individuals from possessing or 
purchasing firearms. One such category, the “mental health prohibitor,” includes individuals who 
have been: (1) involuntarily committed to a mental institution; (2) found incompetent to stand 
trial or not guilty by reason of insanity; or (3) otherwise formally adjudicated as having a serious 
mental condition that results in the individual's presenting a danger to themselves or others or 
being unable to manage their own affairs. In response to the President’s Executive Actions, 

OCR published thttp://www.hhs.gov/news/press/20 1 3pres/04/20l 304 1 ga.html J an advance 
notice of proposed rulemaking (ANPRM) on April 23, 2013, to gather information about 
potential barriers HIPAA may pose to states reporting the identities of those individuals to the 
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background check system, and to solicit the public’s feedback on the best way to address any 
barriers. In particular, we are considering creating an express permission in the HIPAA rules to 
permit certain covered entities to report the relevant information to the NICS. We encourage 
interested parties to submit comments during the comment period, which continues until June 7, 
2013. 

HIPAA Enforcement 

Historically, providers often have been reluctant to share information with patients’ friends and 
family members. Although HIPAA provides the avenues 1 described for disclosures to family 
members and friends, there may be other professional ethical obligations, State confidentiality 
laws, or internal policies of a health care organization, that affect whether health care providers 
are willing or able to share patients’ personal health information with their families, friends, or 
others. In addition, while there are penalties under HIPAA for impermissibly disclosing 
individuals’ health information or for failing to disclose when required, providers are not subject 
to penalties for declining to make disclosures that HIPAA merely permits. Still, the disclosure 
permissions are in the Rule for a reason, and, through guidance, we continue to encourage 
providers to use them. 

With respect to OCR’s enforcement of the HIPAA Rules, HITECH significantly strengthened 
HHS’s ability to take enforcement actions against entities for HIPAA violations by revising and 
increasing the civil monetary penalty amounts that may be imposed for violations, reserving the 
highest penalties for those entities that demonstrate willful neglect of their obligations under the 

HIPAA Rules. Prior to HITECH, HHS could impose on a covered entity a civil monetary 
penalty of up to only $100 for each violation, with a calendar year limit of $25,000 for all 
identical violations. HITECH provided a stronger and more flexible penalty scheme by creating 
four categories of violations that reflect increasing levels of culpability and thus, higher 
minimum penalties - from circumstances where the entity did not know of the violation to 
instances involving willful neglect. Now, the penalties range from $100 to $50,000 or more per 
violation, with a calendar year limit of $1.5 million for identical violations. 
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Under this new structure, OCR largely concentrates its enforcement efforts on large, systemic 
failures to comply with the HIPAA Rules. In particular, as adoption of electronic health records 
becomes more widespread, we are working to ensure that health care entities implement 
reasonable and appropriate measures to safeguard individuals’ health information in electronic 
form, as required by the HIPAA Security Rule. HITECH provided us with important tools in this 
effort, including the new civil monetary penalty structure I just described, which strengthens 
incentives for health care entities and their business associates to secure the information they 
maintain; and the breach notification requirements, which ensure that individuals and HHS learn 
about breaches of unsecured protected health information. We have found that many of the major 
breaches reported to us result from systemic shortcomings in entities’ Security Rule compliance 
programs, and we are focusing our enforcement energy in this direction. 

In contrast, be assured that OCR’s enforcement efforts are not directed toward imposing 
penalties on health care providers who make good faith efforts to comply with the Privacy Rule 
with regard to communications with patients’ family members and friends. 


Closing 

As you can see from my testimony, OCR is committed to ensuring both that the American public 
enjoys the full protections and rights afforded to them by the HIPAA Rules, and that information 
can be shared with the appropriate persons or authorities when it is consistent with individuals’ 
wishes or necessary to protect their safety or the safety of the broader public. 
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Mr. Murphy. Thank you, Mr. Rodriguez. 

Mr. Rothstein, you are recognized for 5 minutes. 

TESTIMONY OF MARK A. ROTHSTEIN 

Mr. Rothstein. Mr. Chairman. 

Mr. Murphy. Pull the microphone close to you, if you would. 

Mr. Rothstein. Mr. Chairman. 

Mr. Murphy. Still not on. Is it on? Pull it real close. 

Mr. Rothstein. OK. How about there? 

Mr. Murphy. There we go. 

Mr. Rothstein. Thank you. 

Mr. Murphy. These are government mikes so during the seques- 
ter they are down 20 percent. 

Mr. Rothstein. As is my voice, I am afraid. 

Mr. Chairman and members of the subcommittee, my name is 
Mark Rothstein. I am on faculty of the University of Louisville, but 
I am testifying today in my individual capacity, and again, let me 
apologize for my laryngitis. It is seasonal I am afraid. 

In my testimony this morning I want to make the following three 
points. First, the HIPAA privacy rule is essential to patient care 
and public health and safety, second, exceptions to the privacy rule 
permit disclosure of health information for important public pur- 
poses, and third, additional measures could enhance the effective- 
ness of the privacy rule. 

First, ever since the Hippocratic Oath, medical codes of ethics 
have established the duty of physicians to maintain the confiden- 
tiality of patient health information. Without assurances of con- 
fidentiality, patients will be reluctant to divulge sensitive informa- 
tion about their physical and mental health, their behavior, and 
lifestyle that could be vital to the individual’s treatment. The pri- 
vacy rule codifies this crucial requirement of confidentiality which 
is necessary for ethical and effective individual healthcare. 

Health privacy laws also are essential to the protection of public 
health and safety. To illustrate, this afternoon I will be returning 
home to Louisville. At lunch, I do want my cook or server to be 
someone who was reluctant to get treatment for hepatitis A be- 
cause of privacy concerns. I do not want as my taxi driver someone 
with chronic tuberculosis who was afraid to get ongoing health 
treatment. I do not want my flight safety placed at risk by an air 
traffic controller with a mental health problem or a pilot with sub- 
stance abuse who was deterred from obtaining behavioral health 
care. Confidentiality protections, therefore, serve to advance both 
the patient’s and the public’s interest. 

Although we were all deeply saddened by the recent horrific loss 
of life caused by some violent, mentally-unstable individuals, we 
should appreciate the potential consequences if new, excessive 
mental health reporting requirements were enacted. Each year in 
the United States there are over 38,000 suicides and over 700,000 
emergency room visits caused by self-inflicted harms. An estimated 
26.2 percent of the people in the U.S. have a diagnosed mental dis- 
order in any given year. Any steps to lessen confidentiality protec- 
tions or mandate the unnecessary disclosure of mental health infor- 
mation could lead vast numbers of individuals to forego mental 
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health treatment and potentially result in significantly more sui- 
cides, self-inflicted harms, and untreated mental illness. 

Second, the privacy rule specifically permits a covered entity to 
disclose 12 types of health information of importance to the public, 
and therefore, the privacy rule does not hinder public safety. 
Among these 12 categories are disclosures for public health activi- 
ties, about victims of abuse, neglect, or domestic violence, for law 
enforcement, and to avert a serious threat to health or safety. 

The 12 public purpose exceptions are permissive. The privacy 
rule does not require any disclosures. The disclosure obligations 
arise from other sources such as state public health reporting laws. 
The effect of the public purpose exceptions is to permit otherwise- 
required disclosures without violating the privacy rule. 

Third, for the last 10 years, inadequate health professional and 
patient outreach and education programs have led to a lack of un- 
derstanding of the privacy rule by many affected individuals and 
covered entities. A common problem is that some uses and disclo- 
sures permitted by the privacy rule are not allowed by some cov- 
ered entities, perhaps out of ignorance or an over-abundance of 
caution. 

The 2013 promulgation of the omnibus amendments to the pri- 
vacy rule make it an appropriate time for HHS to start a new pro- 
gram of public and healthcare provider education and outreach. 

In conclusion, the privacy rule, I believe, is essential to indi- 
vidual healthcare and public health and safety. Additional efforts 
to increase understanding of the privacy rule by the public and cov- 
ered entities, as well as revising some of the public purpose excep- 
tions, will enhance the effectiveness of the privacy rule. 

I thank you for the opportunity to testify this morning. 

[The prepared statement of Mr. Rothstein follows:] 
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MR. CHAIRMAN and members of the Subcommittee. My name is Mark Rothstein. I am the 
Herbert F. Boehl Chair of Law and Medicine and Director of the Institute for Bioethics, Health 
Policy and Law at the University of Louisville School of Medicine. From 1999-2008, 1 served as 
Chair of the Subcommittee on Privacy and Confidentiality of the National Committee on Vital 
and Health Statistics, the statutory public advisory committee to the Secretary of Health and 
Human Services (HHS) on health information policy. 1 am testifying today in ray individual 
capacity. 

In my testimony this morning I want to make the following three points. First, the HIPAA 
Privacy Rule is essential to patient care and public health and safety. Second, exceptions to the 
HIPAA Privacy Rule permit disclosure of health information for important public purposes. 
Third, additional measures could enhance the effectiveness of the HIPAA Privacy Rule. 

1. The HIPAA Privacy Rule Is Essential to Patient Care and Public Health and Safety 

Some people think that the only benefit of health privacy laws is to prevent anxiety, 
embarrassment, and similar intangible harms to individuals; and that occasionally stigmatization 
or discrimination can be caused by the disclosure of sensitive health information. Although it is 
important to protect against these types of harms, it is critical to recognize that the lack of health 
privacy can interfere with individual health care and endanger public health and safety. 

Ever since the Hippocratic Oath, medical codes of ethics have established the duty of physicians 
- and later other health care providers — to maintain the confidentiality of patient health 
information. Without assurances of confidentiality, patients will be reluctant to divulge sensitive 
information about their physical and mental health, behavior, and lifestyle that could be vital to 
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the individual’s treatment. The Privacy Rule codifies this crucial requirement for ethical and 
effective health care. Surveys of patients indicate that many of them, fearful of disclosure of their 
sensitive health information, currently engage in “defensive practices” by withholding certain 
information from their health care providers.* Any weakening of privacy protections would 
undoubtedly increase the use of defensive practices. 

Health privacy laws also are essential to the protection of public health and safety. To illustrate, 
this afternoon I will be going back to Louisville. At lunch, I do not want ray cook or server to be 
someone who was reluctant to get treatment for hepatitis A because of privacy concerns; I do not 
want as my taxi driver someone with chronic tuberculosis who was afraid to get ongoing health 
treatment; I do not want my flight safety placed at risk by an air traffic controller with a mental 
health problem or a pilot with a substance abuse disorder who was deterred from obtaining 
behavioral health care. Confidentiality protections serve to advance both the patient’s and the 
public’s interest. 

Congress recognized the importance of protecting sensitive health information as early as 1970s, 
when it enacted the Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and 
Rehabilitation Act and the Drug Abuse Prevention, Treatment, and Rehabilitation Act. As 
implemented by 42 C.F.R. Part 2, the law protects the confidentiality of alcohol and substance 
abuse treatment information about any person in a federally assisted program. Congress 
understood that the public interest in getting individuals into treatment would be thwarted if 
individuals with substance abuse problems feared they would be subject to, among other things, 
criminal prosecution for violating state and federal drug laws. 

* California Healthcare Foundation, Consumers and Health Information Technology: A National Survey 25 

( 2010 ). 
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A similar recognition of the public health consequences of widespread disclosure of sensitive 
mental health information should guide the nation’s mental health information policy. Although 
we were all deeply saddened by the recent, horrific loss of life caused by some violent, mentally 
unstable individuals, we should appreciate the potential consequences of new, excessive, mental 
health reporting requirements. Each year in the U.S. there are over 38,000 suicides and over 
700,000 emergency room visits caused by self-inflicted harms.* An estimated 26.2 percent of 
people in the U.S. have a diagnosed mental disorder in any given year.* Any steps to lessen 
confidentiality protections or mandate the unnecessary disclosure of mental health information 
could lead vast numbers of individuals to forego mental health treatment and potentially result in 
significantly more suicides, self-inflicted harms, and untreated mental illness. 


2. Exceptions to the HIPAA Privacy Rule Permit Disclosures for Important Public Purposes 

The Privacy Rule specifically permits a covered entity to disclose 12 types of health information 
of importance to the public without the need for a patient’s authorization or consent, so long as 
the disclosures are described in the covered entity’s Notice of Privacy Practices. These 12 
categories are disclosures; (1) required by law; (2) for public health activities; (3) about victims 
of abuse, neglect, or domestic violence; (4) for health oversight activities; (5) for judicial and 
administrative proceedings; (6) for law enforcement; (7) about decedents to coroners, medical 
examiners, and funeral directors; (8) for cadaveric organ, eye, or tissue donation; (9) for research 
purposes pursuant to a waiver of authorization, for reviews preparatory to research, and for 

* Centers for Disease Control and Prevention, Suicide and Self-Inflicted Injury, 
wvw.cdc.gov/nchs/fastats/suicide.htm . 

* National Institute of Mental Health, The Numbers Count: Mental Disorders in America, 
wvw.nimh.nih.gov/health/rmblications/lhe-numbers-count-mental -disorders-in-america/index.shtml . 
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research on a decedent’s information; (10) to avert a serious threat to health or safety [the subject 
of the OCR’s January 15, 2013 letter to health care providers]; (1 1) for military and veterans’ 
affairs, national security, and intelligence; and (12) for workers’ compensation.” These public 
purpose exceptions are broadly worded and include various measures to protect public health and 
safety through the disclosure of protected health information to appropriate federal, state, and 
local government officials. 

Significantly, the public purpose exceptions are permissive. The Privacy Rule does not require 
any disclosures; the disclosure obligations arise from other sources, such as state public health 
reporting laws. The effect of the public purpose exceptions is to permit otherwise-required 
disclosures without violating the Privacy Rule. 


3. Additional Measures Could Enhance the Effectiveness of the HIPAA Privacy Rule 

Before the Privacy Rule went into effect in April 2003, as well as for the last 10 years, 
inadequate health professional and patient outreach and education programs have led to a lack of 
understanding of the Privacy Rule by many affected individuals and covered entities. A common 
problem is that some uses and disclosures permitted by the Privacy Rule are not allowed by some 
covered entities, perhaps out of ignorance or an over-abundance of caution. 

To take one example, in the early days of the Privacy Rule, many covered entities stopped 
reporting infectious diseases and other health information to state public health agencies even 

”45 C.F.R. § 164.512. 
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though such disclosures are expressly permitted by the Privacy Rule.® Although this problem has 
been largely corrected, there are anecdotal reports of other ty'pes of nondisclosure. 

A recurring complaint by some patients and their caregivers is that some covered entities invoke 
the Privacy Rule as an excuse for not making lawful disclosures of health information whenever 
disclosure is considered inconvenient or burdensome. 

The Privacy Rule should be viewed by the public as more than arcane and indecipherable legal 
provisions sometimes invoked to their detriment Similarly, the Privacy Rule should be viewed 
by covered entities as more than a burdensome paperwork regulation whose provisions are only 
vaguely understood. 

The 2013 promulgation of the omnibus amendments to the Privacy Rule make it an appropriate 
time for HHS to start a new program of public and health care provider education and outreach. 
Such efforts have been long advocated by the National Committee on Vital and Health 
Statistics.® 

Another way in which health privacy and public health and safety could be advanced would be 
redrafting some of the public purpose exceptions to make them more explicit. For example, the 
public purpose exception to avert a serious threat to public health or safety includes disclosures 
required by state laws as a result of the influential Tarasoff decision.^ In this case, the California 
Supreme Court held that a psychotherapist who learns of a patient’s threat of serious harm or 


® National Committee on Vital and Health Statistics, Letter to HHS Secretary Tommy G. Thompson, 
March 5, 2004, wvw.ncvfas.hhs.gov/04030512.hnn : 45 C.F.R. § 164.512(b). 

® National Committee on Vital and Health Statistics, Letter to HHS Secretaiy Tommy G. Thompson, 
September 27, 2002, wtTO'.iicvhs.lihs.gov/020927lt.htm . 

’’ Tarasoff V. Regents of the University of California, 551 P,2d 334 (Cal. 1976). 
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death to an identifiable victim has a duty to take appropriate steps to reduce the threat, which 
could include notifying law enforcement and warning the threatened individual. 

Unfortunately, in implicitly deferring to state law on a health care provider’s duty to avert a 
serious threat to public health or safety, the Privacy Rule fails to clarify the complicated and 
inconsistent array of state statutory and case law. An unequivocal, national, unitary standard for 
such disclosures would clear up a great deal of confusion. 

In conclusion, the Privacy Rule is essential to individual health care and public health and safety. 
Additional efforts to increase understanding of the Privacy Rule by the public and covered 
entities, as well as revising some of the public purpose exceptions, will enhance the effectiveness 
of the Privacy Rule. 

Thank you for the opportunity to testify. 
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Mr. Murphy. I thank both the gentlemen. Let me just ask some 
questions. I recognize myself for 5 minutes. 

During this subcommittee’s March 5 forum on severe mental ill- 
ness, Pat Milam, father of a son with a serious mental illness, 
pointed to HIPAA as a significant obstacle to getting his son the 
help he needed. Mr. Milam explained that one of his son’s doctors 
judged him to be, “of extremely high risk for suicide or other bad 
outcome,” more than once and yet failed to share this information 
with Pat or his wife. Matthew Milam tragically took his own life 
only months later while living with his parents, and it was only 
after Matthew’s death that the Milams were able to obtain their 
son’s medical records. 

Is this an example where HIPAA worked as intended, Mr. 
Rothstein? 

Mr. Rothstein. No, but if HIPAA were followed to the letter, 
that would have permitted the disclosure under 

Mr. Murphy. Mr. Rodriguez, you agree with that, too? Does 
HIPAA bar a physician or a licensed provider from revealing health 
information to the parents of a young adult who is living with their 
parents? Yes or no, Mr. Rodriguez? 

Mr. Rothstein. No. 

Mr. Rodriguez. Under some circumstances it might. In most cir- 
cumstances there would be paths for disclosures to those parents. 

Mr. Murphy. Paths for disclosure. Does it allow physicians to 
provide information to parents if the young adult is receiving care 
through the parent’s healthcare plan up to age 26 as envisioned by 
the Affordable Care Act? So if they are still dependents, or is it an 
age? Can you tell me where that cutoff is? 

Mr. Rodriguez. Yes. The cutoff in terms of the patient’s ordinary 
ability to object to the provider’s disclosure is the age of majority, 
whatever it happens to be in a particular State. 

Mr. Murphy. So in Pennsylvania it is age 14. A 14-year-old could 
decide whether or not that information is to be disclosed. In other 
States it may be 18. 

Mr. Rodriguez. Yes. I would assume ordinarily it would be 18. 

Mr. Murphy. Are either of you familiar with the term, 
anosognosia, what that term means? 

Mr. Rodriguez. I am aware of it. Chairman, because I actually 
read the majority memorandum for this hearing. Certainly going 
back to the discussion of serious incapacity and the discussion of 
serious and imminent risk of harm, certainly situations where that 
condition either renders the patient to be in a condition of inca- 
pacity or where the consequences of that condition being 
unaddressed are a serious risk of imminent harm to health or safe- 
ty — again, it doesn’t mean going out and committing a gun crime. 
It can mean a variety of different things that could be extremely 
harmful to that patient. 

Then, yes, in those cases a provider could disclose without con- 
sent. 

Mr. Murphy. Mr. Rothstein, would you agree? 

Mr. Rothstein. I agree. Yes. 

Mr. Murphy. It sounds like from what I read from your testi- 
mony and what you have said here that we may find that a lot of 
providers are misinterpreting or over-interpreting the laws on 
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HIPAA which prevent them from disclosing things to patients. Is 
that what you are suggesting is happening here? 

Mr. Rodriguez. Chairman, we have observed in a variety of our 
areas of enforcement that there is anxiety about our rules in all the 
wrong places. If you look at where we have taken enforcement ac- 
tion, it has been focused on institutions that have had longstanding 
failures to protect the security of all of their patients’ information. 

HIPAA was designed to respect the provider’s judgment as to 
their patients’ best interests. I think that is often, unfortunately, 
misunderstood, and that is one of the reasons we provided that 
clarification. 

Mr. Murphy. Let me ask this because it gets to the crux of the 
matter of why we are here today, and we are going to hear some 
testimony from some professionals, some experts, and some par- 
ents. 

What if the provider decides not to share the memo or the infor- 
mation, whatever, for those reasons? What if the patient doesn’t 
sign a release? A patient themselves does not even recognize they 
have a problem, and the parents even go to court and say, we 
would like to have these records reviewed. In some cases the hos- 
pital staff says, I can’t release these records if a judge says we can, 
and the judge asks the patient, the patient says, no, and yet a con- 
dition may still exist that the patient is at risk for suicide or harm 
to themselves for not following their treatment. 

What then? 

Mr. Rodriguez. One thing to also keep in mind in answering 
this question is HIPAA’s not the only relevant body of law. So we 
are also talking about professional ethical standards, both the 
American Psychiatric Association and the American Psychological 
Association impose clear duties of confidentiality and create excep- 
tions as we do, and, in fact, our rules are built around both those 
ethical duties and State law duties such as, for example, that in 
the Tarasoff v. California Board of Regents case. Clearly in the 
kinds of scenarios where you describe where a provider is aware of, 
for example, the risk of suicide, a very clear situation where we are 
talking about serious risk of imminent harm, HIPAA does not 
stand as a barrier, even in the absence of the patient’s consent to 
disclosure. 

Mr. Murphy. I am going to cut myself 

Mr. Rodriguez. Anybody who can help the patient. That is a 
critical element here. To that person who can lessen or remove the 
threat to the patient. If that is the parents, then that is where the 
disclosure can go. 

Mr. Murphy. Thank you. I am out of time. I am going to go now 
to Ms. DeGette for 5 minutes. 

Ms. DeGette. Thank you, Mr. Chairman. 

I think we can all agree that HIPAA provides many important 
protections for people’s medical privacy, and we have a history of 
bipartisan agreement that people need to be able to keep their sen- 
sitive health information private, and so I think we would agree 
with our witnesses on the importance of HIPAA but also we need 
to recognize that in many of these mass shootings that we have 
seen and in many mental illness situations where someone is a risk 
to themselves and to their families, there are clearly some prob- 
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lems with how providers and institutions are interpreting HIPAA 
ohligations. Because it seems to me if someone is a danger to them- 
selves or to others, that would he up to the provider’s decision to 
advise the parents or other responsible adults. 

Is that correct, Mr. Rodriguez? 

Mr. Rodriguez. Yes. It would 

Ms. DeGette. And Mr. Rothstein, is that correct? 

Mr. Rothstein. Yes. I agree with that. 

Ms. DeGette. So I just want to say I am not going to blindly de- 
fend HIPAA, but I think we should be very, very careful when we 
contemplate changes to that statute. We heard in March about pro- 
viders’ interpretations of HIPAA and how they can be barriers to 
treating not just the mentally but also the physically ill. 

I myself, as a parent, I have a diabetic child, and even before she 
was 18 years old sometimes we had a hard time getting providers 
to give us information. That is not because of HIPAA. It is because 
the providers misinterpreted HIPAA, and so when we hear these 
tragic stories today, and I am hoping I will get back for that, I 
think that we need to really take that seriously, but we need to 
look at ways to educate providers. 

In the aftermath of the murder of 32 people at Virginia Tech we 
learned that HIPAA interpretations prevented mental health pro- 
fessionals from appropriately sharing information. Misinterpreta- 
tions of HIPAA and other private laws were also identified by the 
GAO and by President Obama’s Gun Violence Task Force as an ob- 
stacle to reporting individuals who should be barred from gun own- 
ership to the next background check system. 

And so, Mr. Rodriguez, I think you would say HHS has tried to 
be responsive to these concerns that interpretations of HIPAA and 
other privacy rules have created obstacles. Is that correct? 

Mr. Rodriguez. That is correct. That is why we 

Ms. DeGette. And, in fact, you sent a letter out on January 15 
of this year to health providers around the country, trying to delin- 
eate exactly what HIPAA says. Correct? 

Mr. Rodriguez. Yes, we did. 

Ms. DeGette. Now, tell us why you sent this letter. 

Mr. Rodriguez. We thought that because of all the concerns 
about the interaction between situations where a provider is aware 
of information indicating danger to either the patient or others, 
and some of the events that we have been hearing about in recent 
years, that it was important to remind providers of the — of both 
the duty, the permissions under HIPAA, but also to remind them 
to consult with their applicable ethical standards and their applica- 
ble State laws that clearly do give them a pathway to report in 
these kinds of situations. 

Ms. DeGette. Thank you, and HHS recently issued an advanced 
notice of proposed rulemaking to solicit public comments on HIPAA 
and its perceived barriers to the reporting of individuals to NIGS 
due to mental health concerns. Is that correct? 

Mr. Rodriguez. That is correct. 

Ms. DeGette. And can you explain very briefly why this ad- 
vanced notice of rulemaking is necessary and what information you 
are trying to collect? 
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Mr. Rodriguez. Sure. In most States reporting as to disquali- 
fying information for NICS actually comes from the judicial system, 
which is not covered under HIPAA. We are aware at least gen- 
erally about some examples — New York State until recently was 
one very clear example of a State where reporting occurred from 
entities that are, in fact, covered by HIPAA, and reporting would 
ordinarily have been prohibited by HIPAA. We want to understand 
where and to what extent HIPAA is a barrier in those cases and 
take any appropriate steps to 

Ms. DeGette. Thank you. 

Mr. Rodriguez [continuing]. Remove those barriers. 

Ms. DeGette. OK. Just one last question. 

Now, the Affordable Care Act, it extended insurance to depend- 
ents up to the age of 26. Correct? Yes or no? 

Mr. Rodriguez. That is correct. 

Ms. DeGette. Yes, but it didn’t say that individuals up to the 
age of 26 — maybe that this a good question for you, Mr. Rothstein. 
It didn’t say individuals up to an age of 26 were still considered 
legally dependents of their parents because they are getting health 
insurance. Is that correct? 

Mr. Rothstein. Yes. 

Ms. DeGette. And, in fact, the provision of the Affordable Care 
Act didn’t even talk about HIPAA, did it? 

Mr. Rothstein. Correct. 

Ms. DeGette. That is correct. OK. Thank you. 

Mr. Chairman, I would ask unanimous consent to put this Janu- 
ary 15, 2013, letter from the Director to providers into the record. 

Mr. Murphy. Without objection we will 

Ms. DeGette. Thank you very much. 

[The information appears at the conclusion of the hearing.] 

Mr. Murphy. Thank you. The gentlewoman’s time has expired. 

I now recognize Dr. Gingrey from Georgia for 5 minutes. 

Mr. Gingrey. Mr. Chairman, thank you, and thank you very 
much for calling this very important hearing. You know, I am sit- 
ting here thinking as a physician member of the subcommittee that 
it is kind of ironic, isn’t it, that this law passed in 1996, HIPAA. 
It almost sounds like the Hippocratic Oath, which, of course, in the 
first place, do no harm. It really in a way has nothing to do with 
the Hippocratic Oath, which is hundreds, if not thousands, of years 
old, but in a way it does touch on that in the first place, do no 
harm, in regard to how you treat a patient but also this informa- 
tion sharing because if it is not done correctly, great harm, there 
is potential for great harm, not only for the patient but to the gen- 
eral public. So I just think that I find that sort of ironic. 

Mr. Rodriguez, when was the last time that the Office of Civil 
Rights under HHS updated the Healthcare Provider’s Guide to the 
HIPAA Privacy Rule posted to the OCR Web site? And how about 
the Patients’ Guide? Same thing. 

Mr. Rodriguez. Congressman, Doctor, we are updating guidance 
on a routine basis as different issues comes up. As you know, we 
issued a major rule that profoundly affects both consumers and 
providers in January of this year, and so we have been busy post- 
ing updates relevant to that rule. 

Mr. Gingrey. That was that January 25 rule? 
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Mr. Rodriguez. That is correct. Similarly, when we identified 
the concerns about gun violence after the Newtown shooting, we 
took immediate and decisive steps to put up this reminder about 
the manner in which HIPAA interacts with the duties to warn. We 
are updating our information on a very 

Mr. Gingrey. Well, these guides answer common questions about 
HIPAA. Correct? 

Mr. Rodriguez. That is correct. 

Mr. Gingrey. And do you ever receive input from either the gen- 
eral public or the healthcare providers about the effectiveness of 
these updates? 

Mr. Rodriguez. We do. We speak routinely to both consumer 
groups and provider groups. My door is always open. In fact, I took 
the initiative this morning to connect with several of the family 
members here today because I want to hear from them. I want to 
know these concerns and make sure that we are getting 

Mr. Gingrey. I am going to come right back to you, but Mr. 
Rothstein, are you familiar with these guides? Do you have any 
sense of how effective they are? 

Mr. Rothstein. Well, I am not sure how effective they are, but 
I can comment generally about the Outreach in Education Program 
and with all due respect to OCR and HHS, I think we have a major 
problem in this area. If you read the regulations, there are ample 
places where these kinds of issues, the problem of notifying par- 
ents, the problem of notifying individuals who are at risk, is spelled 
out. But HIPAA is a very misunderstood regulation. It is misunder- 
stood by the public, it is misunderstood by healthcare providers 
and 

Mr. Gingrey. Well, let me interrupt you to say that I fully agree 
with you, and as a practicing physician for a long time before I 
came here 10 years ago, I knew that, and I think, in fact, I wonder 
if some physicians don’t hide behind if I just move onto the patient, 
not want to be bothered with an aunt or an uncle or a cousin, in 
regard to questions about their loved one. I hope that doesn’t exist 
too much, but, I mean, it is something that we need to think about. 

Let me go back to the Director of the Office of Civil Rights, Mr. 
Rodriguez. How does OCR measure? Now, I think when I was talk- 
ing to you just a second ago, it sounded like it was more anecdotal 
from your perspective, but how does OCR measure whether the 
clarifications that you referenced January 25 of this year, indeed, 
how do you measure how they are working? For example, have the 
number of privacy rule complaints filed under the various com- 
plaint categories been trended downwards with every further clari- 
fication, hopefully this most recent one from OCR? Does OCR keep 
track of this? Do you think this will be a helpful metric to track 
in judging the performance, your performance of your outreach and 
education efforts concerning the privacy rule? 

Mr. Rodriguez. So answering the first part of your question. 
Congressman, the truth is our caseload has remained steady, and 
in fact, has grown slightly over the years since we commenced en- 
forcement. We’ve received something in the order of, I think, ap- 
proximately 80,000 complaints since we first began receiving com- 
plaints, and the amount has been fairly steady over the years. 
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Part of what is going on here is HIPAA’s still new, you ref- 
erenced 1996, but our rules really didn’t become final until 2003 
and 2005. And so there has been a learning curve over the years 
both for consumers and providers to understand what HIPAA re- 
quires and what it authorizes, and we often emphasize that 
HIPAA’s flexible and scalable, meaning that it is really meant to 
be designed for a very wide variety of healthcare scenarios. 

I agree generally that our caseload is certainly an indicator. I 
don’t think it is the only indicator of how well folks are under- 
standing the requirements. I certainly agree with that proposition. 
I think there have been surveys. I am not able to speak to them 
specifically right now in terms of where patient concerns are, 
where provider concerns are, but we certainly do hear a lot of anec- 
dotal information as you described. 

Mr. Gingrey. Mr. Chairman, thank you for allowing the wit- 
nesses to answer, and I yield back. 

Mr. Murphy. Thank you. 

Mr. Gingrey. Thank you both. 

Mr. Murphy. I now recognize the gentleman from Iowa, Mr. 
Braley, for 5 minutes. 

Mr. Braley. Thank you, Mr. Chairman, for holding this very im- 
portant hearing which deals with the ongoing struggle between pa- 
tient privacy and protecting the public safety, and these are not 
easy issues to deal with, but I think part of the challenges we faced 
and part of the concerns of family members who have been dra- 
matically impacted by our inability to solve this problem is that 
these particular provisions you have been talking about, Mr. 
Rodriguez, are commonly known as the Duty to Warn Provisions, 
and yet to most of us who understand duty to warn, a duty is a 
mandatory obligation, not a permissive requirement. And even 
though I understand completely your explanation of how this per- 
missive disclosure is then subject to State laws dealing with man- 
datory disclosure, I think many healthcare professionals, particu- 
larly mental healthcare professionals, look at the HIPAA language, 
see that it is permissive, and that is the end of the story for them. 

And I would like to hear from both of you how are we educating 
the public and more specifically mental healthcare providers about 
this bridge between supposedly mandatory Duty to Warn Provi- 
sions that are actually permissive and State law requirements that 
might be mandatory? 

Mr. Rodriguez. So that is one of the issues that I think the 
drafters of our rule in this area were attempting to tackle, because 
we are talking about, I think you are correct, we are talking about 
both duties and authorities to warn. In other words, when we are 
talking about the Tarasoff example, there we are talking about an 
actual duty to warn or to protect. 

Mr. Braley. But based on State law. Not based upon the lan- 
guage of HIPAA. 

Mr. Rodriguez. Correct. HIPAA is really meant to get out of the 
way of those duties and authorities and to clear a wide enough lane 
for those duties and authorities to be utilized and implemented by 
providers and for professional judgment to really be the hallmark 
of when disclosure occurs. 
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Mr. Braley. Well, one of the first forums we had on this subject 
one of our witnesses was Pete Early, who wrote this book about his 
son’s journey through the mental health system and criminal jus- 
tice system, and he noted appropriately in here that in 1963, Presi- 
dent Kennedy signed a National Mental Health Law that author- 
ized Congress to spend up to $3 billion in the coming decades to 
construct a national network of community mental health centers, 
and then notes on the next page that Congress never got around 
to funding or financing community mental health centers. 

So the process of deinstitutionalization moving from State mental 
health institutions to community-based mental healthcare that was 
supposed to happen instead became a process where more and 
more people wound up in the criminal justice system, and we now 
have law enforcement officers who often are providing frontline 
mental healthcare. And I think for the families of some of the vic- 
tims who have experienced firsthand the loss of a loved one be- 
cause of our inability to bridge this gap, especially when a patient 
is accompanied to a treatment facility by law enforcement officials 
who have a duty to protect the public safety and they aren’t pro- 
vided information about the release of that patient, even though 
there may be a prior history of threats, how do we get to the point 
where we are protecting the patient’s privacy and at the same time 
making sure that we aren’t blocking the disclosure of information 
that can protect the public? 

Mr. Rodriguez. I certainly think we need to continue our edu- 
cational efforts, and, again, that is why that initiative — which, inci- 
dentally, was widely covered in professional media — of the re- 
minder we sent in January was something that was really em- 
braced by the mental health profession as a reminder to them that 
at least HIPAA, I can’t account for all the professional codes and 
State laws that also apply here, but at least HIPAA in those kinds 
of situations where a danger is posed does not stand as an obstacle 
to providers acting in the interest of the patient and of public safe- 
ty. 

I think it is also worth noting, you know, that there is a counter- 
vailing concern that patients who fear that their information will 
not be confidential won’t get treated, and I think that is why. Con- 
gressman, when you talked about that delicate and difficult bal- 
ance, that is the balance that both our regulations and healthcare 
providers I believe are trying to strike. 

Mr. Braley. Mr. Rothstein, one of the other concerns that Mr. 
Early raises is that if we have a child in a divorce proceeding or 
a custody proceeding, the number one role of the court system is 
to decide what is in the best interest of the child. That is their 
principle focus. And yet when we have adult patients who are get- 
ting mental health treatment who may or may not be able to make 
decisions about their own treatment needs, oftentimes the legal cri- 
teria are not what is in the best instance of the patient but pro- 
tecting the patient’s wishes from a legal standpoint and that often 
the advocates focus on that rather than getting the best treatment 
option that would benefit them in society. 

What are the obstacles we need to face to deal with that prob- 
lem? 
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Mr. Rothstein. It is a very difficult question. The immediate 
test would be whether the individual is competent, and if the indi- 
vidual is competent, healthcare providers tend to overlook all the 
other tests. If the individual is competent and a threat to self or 
others, then that overrules the competency issue. If the individual 
is incompetent, unable to make reasoned decisions about his or her 
mental health, then the confidentiality protections would not apply. 

Mr. Braley. Thank you. 

Mr. Murphy. The gentleman’s time has expired. 

I now recognize the gentlewoman from North Carolina, Ms. 
Ellmers, for 5 minutes. 

Mrs. Ellmers. Thank you, Mr. Chairman, and thank you for 
holding this very, very important mental health hearing, especially 
in lieu of the forum that we had a couple of weeks ago with the 
family members. You know, that was a very important, emotional, 
and revealing discussion that we had, which brings me to some of 
the questions that I have because I have practiced in healthcare. 
I am a nurse. My husband is a general surgeon, and you know, 
HIPAA can sometimes get in the way, and as healthcare profes- 
sionals I would say that you would typically err on the side of pro- 
tecting the patient’s confidentiality and yourself — as a healthcare 
professional. 

Mr. Rodriguez, I would like to ask you since the implementation 
in 2003, according to my information HHS has received over 79,920 
HIPAA complaints. What is the procedure when a complaint comes 
in? 

Mr. Rodriguez. Sure. The first thing we do is assess whether, 
in fact, it is a HIPAA complaint at all or whether the complaint 
is about some other issue outside of our jurisdiction. If we deter- 
mine that we do have jurisdiction, we then conduct an inquiry. 

Mrs. Ellmers. OK. 

Mr. Rodriguez. Conduct an investigation into the allegations. If 
we determine that there were violations of relevant HIPAA re- 
quirements, we then ordinarily work with the entity — I am going 
to talk about the exception in terms of our Monetary Enforcement 
Program — work with the entity to correct whatever the deficiencies 
are in their practices in order for them to go forward and be com- 
pliant — 

Mrs. Ellmers. OK. 

Mr. Rodriguez [continuing]. In those areas. Now, through 
HITECH as you know, we received enhanced monetary enforce- 
ment authorities, particularly directed at concerns about the secu- 
rity of electronic health information. 

Mrs. Ellmers. OK. 

Mr. Rodriguez. And so, since HITECH was passed, our enforce- 
ment has specifically focused on security rather than the use and 
disclosure issues that we have been talking about here, and has, 
in fact, grown, and in fact, it has been a priority of mine to grow 
our enforcement to protect the confidentiality of electronically 

Mrs. Ellmers. OK. 

Mr. Rodriguez [continuing]. Maintained information. 

Mrs. Ellmers. Yes. Very important. Mr. Rothstein, can you tell 
me, since implementation of HIPAA have there been significant 
law suits filed? Is that something that you would have information 
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about with alleged HIPAA violations? And when I say lawsuits, I 
mean against healthcare professionals. 

Mr. Rothstein. Right. Well, HIPAA does not provide for a pri- 
vate cause of action. 

Mrs. Ellmers. OK. 

Mr. Rothstein. There have been a few lawsuits alleging invasion 
of privacy or some other 

Mrs. Ellmers. OK. So it would have to be 

Mr. Rothstein. But they refer to HIPAA violations, but HIPAA 
doesn’t provide for those. 

Mrs. Ellmers. OK, and there again, I get back to the issue of 
healthcare providers who would err on the side of less information 
is probably better — just, always looking out for the patient and, un- 
fortunately, always having to cover your own self And that is one 
of my areas of concern with HIPAA, because I do believe it is a 
gray area and is left up to too much interpretation. 

So, Mr. Rodriguez, my final question here, I have a little over a 
minute, do you have a sense of how often hospitals and staff actu- 
ally go over the HIPAA regulations and make sure that they are 
up to date? Is that done on an annual basis? 

Mr. Rodriguez. It is. Congresswoman, variable. We actually did 
an audit program last year, which is another program required 
under HITECH, and this was a pilot, and we found a wide range. 
We found some institutions that take those obligations seriously, do 
them on a regular, annual basis, ensure that new employees are 
trained, but there are also many providers where that is not the 
case. The compliance is all over the board. 

Mrs. Ellmers. OK. There again, unfortunately, so many things 
fall on this information. I think this is definitely one of those areas. 
So thank you very much, and I yield back the remainder of my 
time. 

Mr. Murphy. I now recognize Mr. Butterfield for 5 minutes. 

Mr. Butterfield. Thank you, Mr. Chairman. Let me begin by 
thanking both of you for your testimony today. I thank you very 
much. It is obvious that you all are both well prepared. 

I will address this question to Mr. Rodriguez. Mr. Rodriguez, fol- 
lowing the Newtown tragedy President Obama took appropriate ac- 
tion by clarifying to healthcare providers in writing their duty to 
warn law enforcement authorities of threats of violence. 

First of all, is that true? 

Mr. Rodriguez. That is true. I signed the letter, but it was at 
the President’s direction. 

Mr. Butterfield. OK. That was going to lead me to my question 
was it a letter or an executive order, or what was it? It was a letter 
from your office. 

Mr. Rodriguez. The letter was really a reminder of existing du- 
ties under the law and also of the Administration’s emphasis that 
these authorities to warn and these duties to warn should be fully 
exercised to protect the public safety. 

Mr. Butterfield. And has that action had any impact as far as 
you can determine? 

Mr. Rodriguez. It has had impact in the sense that there has 
been renewed discussion about these issues. There was extensive 
industry media coverage of the letter, and so, therefore, we believe. 



31 


based on that, that the reminder reached the folks it needed to 
reach, which are particularly those mental health providers. 

Mr. Butterfield. And about how many letters actually went out 
from your office? 

Mr. Rodriguez. They were posted on our Web site and then dis- 
seminated by both press release and through various listers that 
HHS has. 

Mr. Butterfield. Can you describe, Mr. Rodriguez, additional 
ways the Health Information Technology, HIT, for Economic and 
Clinical Health Act, which we passed in the Recovery Act, has im- 
proved privacy and security requirements for patient records? 

Mr. Rodriguez. Sure. I appreciate that question. First of all, it 
has done so by bringing business associates within the ambit of the 
privacy and security worlds. That is those contractors who serve 
healthcare providers, and in fact, often come into possession of 
large quantities of protected health information. We now directly 
regulate them as we directly regulated healthcare providers before 
that. It increases the penalties for violation of HIPAA, which we 
have used extensively for security violations, and it also establishes 
requirements that breaches of health information need to be re- 
ported to our office, to the affected patients, and in cases of larger 
breaches, also be reported to prominent media that will be seen by 
the affected patients. 

Mr. Butterfield. All right. My third question follows. Can you 
describe the training that medical professionals receive to ensure 
they adhere to HlPi^? 

Mr. Rodriguez. Sure. To my knowledge, and I wouldn’t consider 
this a comprehensive answer, but certainly training on HIPAA is 
offered at many professional conferences. In fact, we actually have 
prepared a series of videos that have been posted, and several more 
that will be posted on Medscape, including some that are, by the 
way, relevant to the topic we are discussing here, that discuss var- 
ious aspects of the privacy and security rules. 

We are particularly concerned about smaller providers who don’t 
necessarily have the resources of larger institutions. So we are 
looking for opportunities to reach them. 

I also understand that there are medical school curricula that 
touch on these issues as well. 

Mr. Butterfield. It is my understanding that healthcare pro- 
viders covered by HIPAA must notify patients if the privacy of 
their health information is breached. What methods are used to no- 
tify those individuals? 

Mr. Rodriguez. They should ordinarily be notified in writing, 
and, again, we also in certain cases provide for notification through 
the media. 

Mr. Butterfield. All right. Finally, Mr. Rothstein, Dr. 
Rothstein, even with HIPAA protections we have heard that pri- 
vacy concerns can cause individuals to actually avoid treatment. I 
am not sure I knew that. 

Could increasing information sharing through HIPAA cause 
fewer individuals to seek treatment? 

Mr. Rothstein. That certainly is a concern, especially individ- 
uals who have sensitive information that they are worried will be 
disclosed. Yes. 



32 


Mr. Butterfield. All right. Mr. Chairman, I yield back. 

Mr. Murphy. I thank the gentleman. 

Dr. Cassidy is not a member of the Oversight and Investigations 
Subcommittee but has asked for an opportunity to join us and 
without objection we will allow him 5 minutes to ask questions. Dr. 
Cassidy. 

Mr. Cassidy. Thank you, Chairman Murphy. 

Gentlemen, I am a practicing physician, will see patients this 
Tuesday morning, and I have a sense that you two are incredibly 
bright and well-versed in this law and is totally divorced from the 
reality of an ER physician seeing 20 patients in a shift, and at 3:00 
a.m. there is a person who comes in with these issues. 

I will just tell you, and I will also tell you that physicians fear 
the Federal Government. They understand that if the Federal Gov- 
ernment comes after them and grabs them in their long legal arm, 
the physician may ultimately win, but she is destroyed in the proc- 
ess. 

Now, I listened to what you say how this would allow certain 
forms of communication, but I will also say when I read that the 
maximum penalty is 1.5 million, when the physician is having 
their in-service on HIPAA, that is what they remember, and when 
they understand that it is permissible not to give information, but 
you may get in trouble if you do, I can tell you that guy, that gal 
seeing the patient at 3:00 a.m. with 20 patients doesn’t have your 
expertise, but what they do have are examples of physicians who 
had been grabbed by the law and not let loose until every one of 
their personal resources had been exhausted. 

Now, that is just a comment borne out of incredible frustration 
with this sense that the Federal Government is this benign entity 
that the American people have no reason to fear. Indeed, it has 
great reason to fear, and so people act cautiously. 

Now, that said, after my rant, I apologize, let me ask a couple 
things. We say that the doc may communicate with the family if 
there is imminent danger, but what if the patient is non-compliant? 
Can the family say to the mother of the adult child who lives with 
her, your son is not taking his medicines, and therefore, we need 
to do something about that? Can the physician do that? 

Mr. Rodriguez. So, again, we go back to the idea of serious risk 
to health or safety. So we are not talking about imminent danger 
in the sense of somebody violent going out, and it certainly includes 
that scenario, but it is much broader than that. So if the patient’s 
health would be seriously, adversely affected and the provider’s 
communication of that information to the parent would provide a 
way of eliminating or at least reducing that threat, then HIPAA 
provides them clear authority. 

Mr. Cassidy. So the specific example, the patient is bipolar, and 
I am a little rusty on my psyche so this medicine may no longer 
be used, but assume that they are on Lithium, and their Lithium 
level shows that it is low, the patient is not taking their drug. We 
have documented fact. Can the doc say to the mom, your son is not 
taking his Lithium? 

Mr. Rodriguez. You also might have heard the beginning of my 
testimony. We were also talking of cases of incapacity. 

Mr. Cassidy. Of what? I am sorry. 
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Mr. Rodriguez. Of incapacity. 

Mr. Cassidy. No. I am not saying they are incapacitated because 
when that level falls, they don’t immediately become incapacitated. 
They are just on the potential verge of being but they can still 
seem sane. 

Mr. Rodriguez. Well, then I think the pathway is — if the result 
of that would be serious and imminent threats to that individual’s 
health, then HIPAA provides a path for those communications. 

Mr. Cassidy. There seems to be a little bit of wiggle room there. 
The guy could get back on his dose and bring it back up to snuff. 
I am not sure the physician would find a safe harbor in that kind 
of answer. 

Mr. Rodriguez. Well, I think the greater safe harbor. Congress- 
man, would be this: We have received 80,000 complaints since we 
began enforcing. Only 12 of them have resulted in monetary pen- 
alties. 

Mr. Cassidy. I accept that, but what you are talking about is a 
fellow seeing patients 20 in a shift at 3:00 a.m. in the morning who 
doesn’t have your expertise. That is the reality, and I can tell you 
that what you hear in that in-service is that if you violate HIPAA, 
they are going to turn you every which way but loose. I can tell 
you that is what the in-service is because I have been there. 

Mr. Rodriguez. I would love to see those in-services because 
they are not consistent with our enforcement history. 

Mr. Cassidy. Secondly, it says here that the patient healthcare 
provider is not permitted to share personal information with the 
family or friends of an adult who tells the provider not to do so. 
What if that patient is incompetent? What if they actually at this 
point in time are not lucid? They think that there is black heli- 
copters circulating and that their mom is the pilot of one of them. 

Mr. Rodriguez. And that is why I mentioned that, certainly in 
cases of incapacity, and certainly incapacity can include a situation 
where a patient is far from lucid, then in those cases there is also 
a basis for 

Mr. Cassidy. Now, sometimes lack of lucidity is in the eye of the 
beholder. I will tell you that there is a Wall Street Journal article 
about William Brice or Bruce, I forget which, in which the young 
man was released and went out and killed his mother with a 
hatchet. And so clearly he was considered lucid enough to be re- 
leased. 

I am sorry. I am out of time. I apologize. I will have to forego. 
I yield back. I am sorry. 

Mr. Murphy. The Chair is going to ask that everybody be per- 
mitted 1 minute of additional questions, and then we will get onto 
our next panel, recognizing we have votes coming up soon. So we 
will do 1 minute. 

Mr. Rodriguez, as you are aware. States have said, confusion 
over HIPAA has prohibited them from sharing 1.5 million records 
with the National Instant Background Check System of persons 
who have been involuntary committed to mental health treatment 
or deemed mentally incompetent by a court of law and are, there- 
fore, prohibited from owning a firearm. Our committee sent a letter 
to HHS on February 13 asking about HIPAA interfering with this 



34 


NICS list. I note that HHS has now announced it would he solic- 
iting feedback on HIPAA reform. 

Why do you believe States are not uploading those records? 

Mr. Rodriguez. I certainly have heard of HIPAA as one of sev- 
eral different reasons, so I don’t understand HIPAA to be the only 
reason. I know certainly in the case of New York State their report- 
ing was coming out of, or their reporting would have had to have 
come out of, what was a HIPAA-covered entity and therefore, re- 
porting would have been prohibited, and we are now looking to 
eliminate that kind of barrier. Beyond New York I don’t know if 
there are others. 

Mr. Murphy. Can you get us a written response to the sub- 
committee on this issue clarifying it? 

Mr. Rodriguez. Sure. 

Mr. Murphy. Thank you. Mr. Braley, 1 minute. 

Mr. Braley. Mr. Rothstein, we were talking earlier about some 
of the challenges faced with the incredible burdens placed on law 
enforcement officials, our penal systems to provide front-line men- 
tal healthcare. This has been a dramatic shift in what has hap- 
pened since Congress passed legislation trying to promote commu- 
nity-based mental health. 

So we now have this long learning experience, and people who 
care about the rights of the mentally ill, like I do, people who care 
about protecting public safety, like I do, want to know what we 
have learned from these experiences as we move forward and try 
to create a balanced system that is protecting the public and the 
rights of patients to get the best possible treatment when obviously 
we have been failing them. What can we do about that? 

Mr. Rothstein. Well, Mr. Braley, that is a difficult question. On 
the one hand we need to increase the funding and wherewithal of 
community mental health services. That is for sure. What we can 
address at this hearing today is the importance of getting out the 
message of what HIPAA does and does not require. 

One of the problems overall is that HIPAA was intended to be 
a floor above which medical ethics and State law would take place, 
but in many areas, including mental health areas, it is the floor, 
and there is nothing else above it. 

Mr. Murphy. If you can offer a written response, too, we would 
appreciate that, because we are going to need more detail. 

Dr. Gingrey, you are recognized for 1 minute. 

Mr. Gingrey. Mr. Chairman, thank you. I don’t know if I can do 
this in a minute but quickly. 

Mr. Rodriguez, on January 25, 2013, HHS published a final rule 
that makes, and I quote, “significant modifications to marketing by 
third parties to patients for purposes of identifying potential bene- 
ficial health opportunities for patients.” For instance, many drug 
companies use third parties to help identify patients in need of care 
for purposes of inclusion in clinical trials. Some of these patients, 
including those from my own district, have chronic illnesses for 
which no other treatment option exists. 

Would this service still be allowed if such a company, third-party 
company, did not first get the patient’s consent? 

Mr. Rodriguez. It is a long answer, so I will take advantage of 
the opportunity to offer it in writing. 
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Mr. Gingrey. All right. Thank you, and I yield back. 

Mr. Murphy. Dr. Cassidy, 1 minute. 

Mr. Cassidy. Mr. Rothstein, I am little concerned. You men- 
tioned the point there is 26 percent of the people who have a diag- 
nosed mental disorder in 1 year, but really if you talk about serious 
mental illness it is really a much smaller percentage. 

Mr. Rothstein. Of course. 

Mr. Cassidy. And those are the folks who are incompetent that, 
I mean, believe me, I speak from personal experience of family 
members and of friends who have been in this situation. Don’t you 
think it is a little disingenuous to say, OK, here is a group that 
truly are out of it as opposed to this 26 percent that have situa- 
tional depression or such like this. 

Wouldn’t it be more honest to kind of focus upon that SMI group 
for their sake, their family’s sake as a unique group? 

Mr. Rothstein. Oh, absolutely, but the point I was trying to 
make was, if legislation were enacted that made all mental health 
records more discloseable 

Mr. Cassidy. So you would accept maybe SMI under very guard- 
ed circumstances 

Mr. Rothstein. Of course. 

Dr. Cassidy [continuing]. As opposed to the broader 26 percent 
of the population? 

Mr. Rothstein. That is correct, but I am worried about the dis- 
couragement of the 26 percent. 

Mr. Cassidy. I would just say, someone who has got bipolar or 
schizoaffective oftentimes does not have that insight, and I think 
we have to be kind of honest about that. They have an acute break, 
and they have no insight whatsoever. As a guy who has worked 
with such patients and who has had close people associated. 

I yield back. Thank you. 

Mr. Murphy. Thank you. Mr. Rodriguez, Mr. Rothstein, thank 
you so much for being with us today, and we appreciate your avail- 
ability in the future to respond to questions. 

As they are stepping up, we ask the folks to get ready for the 
second panel. I would like to make an announcement. 

As we continue on with our previous hearing after Newtown and 
also this one on HIPAA, this committee is exploring issues of a 
wide range that deal with mental illness and proper treatment, et 
cetera, because of our concerns. 

I want to make it very clear, all members are aware of this, but 
certainly members of the audience and people who may be watch- 
ing this also, at no time does this committee at any time commu- 
nicate that those with mental illness are those who are responsible 
for violence. We recognize that victims, that they are actually 11 
times more likely to b^e victims of violent crime than the non-men- 
tally ill, and the vast majority of people with mental illness are not 
violent. It is very important we understand that. 

Could the next panel please take their seats, and we will move 
forward then? 

As you sit down I will be introducing you. On the second panel 
we have Dr. Richard Martini. He is a Professor of Pediatrics and 
Psychiatry at the University of Utah School of Medicine and the 
Chair of the Department of Psychiatry and Behavioral Health at 
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the Primary Children’s Medical Center in Utah. For full disclosure 
I want to say that when I was on the staff at Children’s Hospital 
in Pittsburgh he was one of my students. How time flies. 

We also have Ms. Carol Levine. She directs the United Hospital 
Fund Families and Health Care Project, which focuses on devel- 
oping partnerships between healthcare professionals and family 
caregivers, especially during transition in healthcare settings. 

Next we have Mr. Gregg Wolfe. Mr. Wolfe is the father of a son 
who suffered from mental illness and substance addiction. 

Then we have Mr. Edward Kelley. Mr. Kelley is also a father of 
a son with mental illness. 

And Mr. Braley, would you like to also recognize your guest 
today? 

Mr. Braley. Yes. Thank you, Mr. Chairman. I am thrilled to 
have one of my constituents testify today, Jan Thomas, from Par- 
kersburg, Iowa. She has a story to tell about this gentleman who 
was featured in Sports Illustrated after he was gunned down by a 
former student. He was the NFL national high school coach of the 
year with four of his former players playing in the National Foot- 
ball League, and Jan has an important story to share with us 
about these issues. 

Mr. Murphy. Thank you and finally we have Ms. Deven 
McGraw. Ms. McGraw is the Director of the Health Privacy Project 
at the Center for Democracy and Technology. 

As you all are aware, the committee is holding an investigative 
hearing, and when doing so, has a practice of taking testimony 
under oath. Do any of you have any objections to testifying under 
oath? 

The Chair then advises that under the rules of the House and 
the rules of the committee you are entitled to be advised by coun- 
sel. Do you desire to be advised by counsel during your testimony 
today? 

All answer negatively. In that case would you all please rise and 
raise your right hand, and I will swear you in. 

[Witnesses sworn] 

Mr. Murphy. The Chair recognizes all of the participants an- 
swered in the affirmative. You are now under oath and subject to 
the penalties set forth in Title XVIII, Section 1001 of the United 
States Code. You may each now give a 5-minute summary of your 
written testimony. 

We now recognize Dr. Martini for 5 minutes. Make sure your 
microphone is on and pulled close. Thank you. 
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TESTIMONY OF RICHARD MARTINI, M.D., PROFESSOR OF PEDI- 
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OF MEDICINE, CHAIR, DEPARTMENT OF PSYCHIATRY AND 
BEHAVIORAL HEALTH, PRIMARY CHILDREN’S MEDICAL 
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CARE PROJECT, UNITED HOSPITAL FUND; GREGG WOLFE, 
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ABUSE; EDWARD KELLEY, FATHER OF A SON WITH MENTAL 
ILLNESS; JAN THOMAS, FAMILY IMPACTED BY HIPAA; AND 
DEVEN MCGRAW, DIRECTOR OF THE HEALTH PRIVACY 
PROJECT, CENTER FOR DEMOCRACY AND TECHNOLOGY 

TESTIMONY OF RICHARD MARTINI, M.D. 

Dr. Martini. Good morning, Chairman Murphy, members of the 
subcommittee. I also want to say I am also an immediate past 
Board Member of the American Academy of Child and Adolescent 
Psychiatry, who paid for my travel here today. Thank you for invit- 
ing me to come and to speak with you about HIPAA and its impli- 
cations of clinical practice and to participate in this discussion. 
Throughout my testimony I will be reviewing patient summaries 
that are based upon my clinical experience but that do not include 
easily-identifiable information. 

Decisions about the release of psychiatric information are cer- 
tainly more straightforward when the patient is a minor and not 
emancipated. Parents or primary caregivers are involved in the 
process, are available not only to support the patient, but also to 
guide them into psychiatric care. Young patients do not typically 
recognize the nature or extent of their behavioral and emotional 
problems, and this is one reason why child and adolescent psychia- 
trists, as well as other pediatric mental health professionals, are 
trained to involve families in diagnosis and treatment. We also 
know that this improves outcome. 

All pediatric specialties struggle with the transition of patients 
from adolescence into young adulthood, from a period of depend- 
ence to a period of almost complete autonomy. Many are not pre- 
pared for the responsibility, particularly those patients that experi- 
ence chronic medical illnesses, developmental delays, and psy- 
chiatric disorders. Families have provided a framework for their 
care and for many aspects of their life. 

One of my patients, a former patient with a mild form of autism, 
developmental delay, and an anxiety disorder was determined to 
move out of the home once he was employed. The parents knew, 
however, that he could not manage his money, that he was emo- 
tionally reactive when faced with new experiences, and he really 
could not track his medications. Nevertheless, he did not want his 
parents involved in routine care. It forced the parents to go to 
court, state that their son was not able to care for himself, and 
must be dependent. Unfortunately, the subsequent ruling in their 
favor was counter to our goals in psychiatric treatment, and it de- 
railed his progress in therapy. 

Psychiatrists spend a lot of time negotiating communications be- 
tween parents and their children, and we don’t want to discourage 
anyone from accessing care, specifically those who will not seek 
treatment if they believe that someone will contact or involve their 
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parents. However, the application of HIPAA regulations should be 
a negotiation with several options available to both the clinician 
and the patient. A patient of mine in his early 20s suffered from 
a long history of congenital kidney disease. He was in and out of 
the hospital, usually in the company of his mother. He came into 
treatment because he was angry and depressed over the cir- 
cumstances of his disease and his subsequent organ transplan- 
tation. I wanted to involve the mother in therapy as a support, but 
he refused because he was concerned about how disappointed she 
would be given everything that they had gone through together. He 
was in treatment for about a year, and he was on antidepressant 
medications but dropped out of treatment because it was too dif- 
ficult. Two years later, I ran into his physician who told me that 
he discontinued his kidney medications, went into renal failure, 
and died. 

Psychiatrists should be able to both respect the individuality of 
the adolescent or young adult under the legal protection of HIPAA 
and use the strengths of the family when necessary to support 
treatment. I recognize that allowing more communication and less 
privacy for an adult patient at risk for a serious mental illness is 
a significant change in the intent of the law, but must we wait for 
a patient to be considered at risk for imminent harm to self or oth- 
ers before seeking help from parents or family? 

Rules about confidentiality certainly affect situations that are 
relatively more common among adolescence and young adults, like 
going to college. Parents are told that even though they are going 
be paying the bills, they will not have access to any medical or psy- 
chiatric information without the student’s permission. One such pa- 
tient with a history of congenital heart disease and ongoing depres- 
sion wanted to go away to college. Her parents wanted her to stay 
close to home. She prevailed, but within 3 months of going to 
school, she began to deteriorate both medically and psychiatrically. 
The Student Health Center knew that she was ill but without her 
permission could not contact the parents. If this patient had a real- 
ly serious disorder with immediate consequences, the family may 
not find out about it until they receive a bill some 30 days after 
the event. If there is a bias in these situations, should it be toward 
parental involvement more than away from it? 

Mental health professionals strive to do what is in the best inter- 
est of the patient, while preserving his or her right to privacy and 
protection under the law. The basis for civil commitment and fam- 
ily communication regardless of the patient’s wishes has been risk 
of harm to self or others. I suggest that this standard be reexam- 
ined with the goal of involving families whenever possible. 

Thank you, Mr. Chairman. 

[The prepared statement of Dr. Martini follows:] 
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Good morning. Chairman Murphy, ranking member DeGette and members of the subcommittee. 
My name is Dr. Richard Martini, and I am currently Professor of Pediatrics and Psychiatry at the 
University of Utah School of Medicine and Chair of the Department of Psychiatry and 
Behavioral Health at Primary Children’s Medical Center in Salt Lake City. 1 have been a 
practicing child and adolescent psychiatrist for over 25 years, and am an immediate past board 
member of the American Academy of Child and Adolescent Psychiatry, who paid for my travel 
here today. 

Thank you for inviting me to come and speak to you about HIPPA and its implications in clinical 
practice, and to participation in this discussion. Throughout my testimony I will be reviewing 
patient summaries that are based on my clinical experience, but that do not include easily 
identifiable information. 

Privacy and confidentiality between a physician and his/her patient is paramount. When asked 
for patient information, physicians should make reasonable efforts to disclose only what is 
necessary for the purpose requested. However, physicians are required to release medical 
information, even without the patient's written consent, when they have concerns that he or she 
may be at risk for immediate harm to themselves or others, and when ordered by a court. 

Decisions around the release of psychiatric information are more straightforward when the child 
or adolescent is a minor and not emancipated. Parents and/or primary caregivers are involved in 
the process and are available not only to support the patient, but also to guide them into 
psychiatric care. Young patients do not typically recognize the nature or the extent of the 
behavioral and emotional problems that affect them, and this is one reason why child and 
adolescent psychiatrists as well as other pediatric mental health professionals, are trained to 
involve families in diagnosis and treatment. We also know that this improves outcome. All 
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pediatric specialties struggle with the transition of their patients from adolescence to young 
adulthood, from a position of dependence to one of complete autonomy. Many are not prepared 
for the responsibility, particularly those with chronic physical illnesses, developmental delays, 
and psychiatric disorders. Families have provided a framework for their care and for many 
aspects of their life. When that framework is removed, some patients believe that this is an 
opportunity for them to manage their own lives, and to assert themselves apart from parents and 
family members. A former patient with a mild form of autism, developmental delay, and an 
anxiety disorder was determined to move out of the home and into his own apartment once he 
was able to get a janitorial job at a local airport. His parents knew that he could not manage 
money, reacted emotionally when faced with anything outside of his experience, and was unable 
to keep track his medications. Nevertheless, he did not want his parents involved in his care, and 
because of HIPPA regulations, the only way that the parents could address their concerns was by 
going to court and stating that their son could not care for himself and must remain dependent. 
Unfortunately, the subsequent ruling in their favor was counter to our goals of psychiatric 
treatment and derailed his progress in therapy. 

Health professions train with an emphasis on HIPPA and its attached liability penalties, and may 
not practice with the appropriate clinical sensitivity that balances patient and family engagement. 
Psychiatrists spend a lot of time negotiating communieations between parents and their children 
and we don't want to discourage anyone from accessing care, specifically those who will not 
seek treatment if they believe that someone will contact or involve their parents. However, 
application of HIPPA regulations should be a negotiation with several options available to both 
the patient and the clinician. A patient of mine in his early 20’s suffered from a congenital 
kidney disease and spent his life in and out of hospitals, with his mother by his side, until her 
received a transplant in his late teens. 1 saw him in therapy because he could not accept the 
changes his illness and the transplantation made in his life, particularly when he compared 
himself to same age peers. He created stories to explain his scars and was angry and depressed 
over his situation. I wanted to involve his mother in therapy both as a support and as a source of 
information to better understand his experience as a renal patient. He refused because he 
believed that his mother would be disappointed in his behavior given all that they shared 
together. After a year in therapy with a trial of antidepressants, he dropped out of treatment, 
finding it too difficult. Two years later 1 learned from his physician that he discontinued his 
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kidney medications, went into renal failure, and died. Psychiatrists should be able to both 
respect the individuality of the adolescent or young adult under the legal protection of HIPPA, 
and use the strengths of the family when necessary to support treatment. I recognize that 
allowing for more communication and less privacy for an adult patient at risk for serious mental 
illness is a significant change in the intent of the law. Must we wait for a patient to be 
considered at risk for imminent harm to self or others before seeking help from parents or 
family? The State of Tennessee, for example, created a treatment review team of physicians that 
can override HIPPA regulations when it is believed to be in the best interests of the patient’s 
health. The challenge is in where and when to draw that line. 

Rules about confidentiality affect situations that are relatively common in adolescence and young 
adulthood, including enrollment in college. When a young adult begins her college education, 
parents are told that although they will be paying the bills, they will not be given any medical, or 
psychiatric information about their child without the student’s permission. Family members as 
well as medical and mental health professionals must negotiate with a young adult whose 
priorities may be very different than their own. One such patient with a history of congenital 
heart disease, multiple cardiothoracic surgeries, and depression wanted to go away for her 
college education. Mother preferred that she stay in town, in close proximity to the children’s 
hospital where she received her care. The patient prevailed and enrolled in a small rural college 
approximately 200 miles from home. Within three months, she began to struggle, not with 
academics but with her energy level and her depression. She colluded with her older brother 
who drove to her dorm the day before her parents would arrive and cleaned her room, did her 
laundry, and organized her schoolwork. The patient knew that if her parents discovered the 
extent of her troubles, she would be forced to transfer back home. The Student Health Center 
knew that she was struggling, but could not talk to the parents without her permission. Now 
imagine that this patient had a history of a serious mood disorder, a substance abuse disorder, or 
an eating disorder, all with serious consequences. The only indication for the parents that there 
is a problem may be a bill from the Student Health Center that arrives 30 days after an event. If 
there is a bias in these situations, should it be toward parental involvement rather than away from 
it. 
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Through the Affordable Care Act parents are now allowed to keep their young adult children on 
their health insurance until age 26. I support this and believe that it will ensure the provision of 
needed medical and mental health services. However, it is unclear who owns the record and 
what rights the parents have to their young adults health information. It creates a new grey area 
in terras of respecting the adult patient who is receiving benefits as a dependent of a parent. 

Mental health professionals strive to do what is in the best interests of the patient, while 
preserving her right to privacy and protection under the law. The basis for civil commitment and 
family communication regardless of the patient’s wishes has been risk of harm to self or others. 

I suggest that this standard be reexamined with the goal of involving families whenever possible. 
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Mr. Murphy. Thank you, and Ms. Levine, you are recognized for 
5 minutes. 


TESTIMONY OF CAROL LEVINE 

Ms. Levine. Chairman Murphy, members of the committee, 
thank you very much for inviting me here today. I am at the other 
end of the age spectrum. I work with family caregivers of older 
adults who are with multiple chronic illnesses, and I think the im- 
portance of my experience for your deliberations is that the mis- 
interpretations of HIPAA which we have heard about from Mr. 
Rodriguez and Mr. Rothstein are far more pervasive than the spe- 
cific questions of mental illness. 

There are about 42 million Americans who are taking care of 
their chronically-ill older parents or other relatives, and I can’t tell 
you how many times I hear from family caregivers who have a par- 
ent in the hospital, and the family member is expected to do a 
wound care, multiple medications, monitor machines, make all the 
care coordination in the community, and when you ask about what 
do I need to know to do this, they say, well, I can’t tell you because 
of HIPAA. And that is just simply wrong and why does it happen? 
Because of the two features that have already been mentioned. 

There is this training that emphasizes the scary aspects of 
HIPAA. It is often done in a way that if you say anything, you are 
going to be in big trouble. That — and if the training doesn’t say 
that, then the informal communication among healthcare pro- 
viders, particularly from the mid-level staff, it is not necessarily 
physicians but nurses, social workers, others, terrified that they 
are going to get sued, they are going to lose their job. Meanwhile, 
laptops lie all over the place. They are not paying attention to the 
actual security of this information. 

The second reason, and I think this is very pervasive, also al- 
luded to, HIPAA has become a very convenient excuse to avoid dif- 
ficult conversations with families. It takes time, it is sometimes un- 
comfortable, it has really nothing to do with privacy of the patient’s 
information. It has to do with I don’t — why am I — why do I have 
to talk to this daughter? Why can’t I just tell the patient? Well, 
fine, if the patient is totally able to understand, but an 85-year-old 
woman with congestive heart failure, moderate dementia, 55 other 
medications and so forth, just cannot absorb that information. 

So I think that what we really need is far more education on a 
balanced level. I think it is instructive that our next. United Hos- 
pital Fund’s Next Step in Care Web site, guides for family care, the 
most downloaded guide is the one to HIPAA. So people are con- 
fused, and they are looking for information. And I think that hos- 
pitals, the covered entities, wherever they are, need to be encour- 
aged to provide understandable information to their patients, to the 
families, to everyone they deal with. You go to a hospital now, you 
get a piece of paper to sign or several pieces of paper, you can bare- 
ly understand. I think only Mr. Rothstein and Mr. Rodriguez and 
several members of the committee here would actually be able to 
understand it, and mostly it is about what we could do with your 
information. It is not about protecting the patient’s interests at all. 

I think my ultimate question is always whose interests are being 
protected? Is it the patient’s interests? Is it the staff members’ in- 
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terests in not getting into trouble? I appreciate that. Or is it the 
institution’s interests in not making any kind of — not being, also 
not being in trouble, and those are valid, but they should never 
override the good clinical care, the importance of good communica- 
tion that older people, younger people, everyone needs to get the 
best possible clinical care. So it is a very pervasive problem. It goes 
beyond what you are specifically asking about, but I think in all 
it is a kind of waterfall. Once it starts, it keeps going, and we con- 
tinue to hope for more clarification. 

Thank you. 

[The prepared statement of Ms. Levine follows:] 
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SUMMARY OF KEY POINTS 


Family caregivers - defined broadly as persons who have a continuing role in providing, 
managing, or paying for patient care - are responsible for demanding technical and 
emotionally stressful tasks following a hospital or nursing home discharge. They need 
information and training to do this job. 

HIPAA specifically permits disclosure of relevant information to people who meet this 
description. 

Yet when family caregivers ask questions about the patient’s care, they are routinely told 
“I can’t tell you because of HIPAA.” This is not only contrary to the law, it is not good 
clinical care and Jeopardizes the patient’s well-being. 

HIPAA has been misapplied for two main reasons, both related to protecting the interests 
of professionals or organizations, not patients’ privacy or other interests: 

o Fear of legal or financial liability reinforced by “HIPAA scare” training, 
o HIPAA provides a convenient excuse for not talking to families, which is 
something many health care professionals prefer to avoid anyway. 

OCR should strongly reinforce the provision in HIPAA that permits disclosure to 
involved persons and should urge staff retraining on the law. 

CMS should urge hospitals and other covered entities to review their policies and 
practices to merge privacy considerations with good clinical care. They should also 
develop simple statements for patients and families about the protections in place for the 
security of data and how their data will be shared with other organizations. 
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Chairman Murphy, Ranking Member DeGette, and Subcommittee members, I am honored to be 
with you today to talk about the experiences of family caregivers with HIPAA, the federal 
privacy law. 

My approach to this subject starts with a few basic assumptions. 

• First, good clinical care depends on good communication. 

• Second, HIPAA was not intended to override good clinical care. 

• Third, the interests of the patient, not health care professionals or organizations, should 
be uppermost in considerations about privacy. 

• Fourth, most patients, particularly those with chronic or serious illnesses, are not isolated 
individuals living in a world of abstract principles or hypothetical situations. They, like 
all of us, exist in a network of relationships that give meaning to their lives and support 
them through their illnesses. Family - defined broadly to include people the patient 
identifies and trusts whether they are related by blood or marriage - are at the center of 
this network. 

• Fifth, the health care and long-term care systems in the community could not exist 
without the unpaid contributions of family members. 


Although it was not the intent of the law, HIPAA has been interpreted and misapplied as a 
barrier to communication with the very people who have a deep and often lifelong relationship 
with the patient and who will be responsible for managing or providing care in the community. 
When a family member asks almost any question relating to a family member’s care and 
treatment, this is what they too often are likely to hear: “I can’t tell you because of HIPAA.” 


End of conversation. 
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This is a misinterpretation of HIPAA. Here is what the Health and Human Services’ Office of 
Civil Rights, responsible for monitoring HIPAA, says: “The HIPAA Privacy Rule at 45 CFR 
1 64.5 10(b) specifically permits covered entities to share information that is directly relevant to 
the involvement of a spouse, family members, friends, or other persons identified by a patient, in 
the patient’s care or payment for health care.” The only exception is if the patient objects. I will 
say more about that later. 

Family Caregivers and Why They Need Patient Information 

Before I suggest some reasons why this discrepancy between the law and its implementation 
exists, let me say a few words about family caregivers. There are an estimated 40-50 million 
family caregivers in the U.S. The unpaid labor of these relatives, partners, and friends is 
estimated to be worth $475 billion a year.' They provide 80-90% of the long-term care in the 
community for an aging population with multiple chronic conditions, including Alzheimer’s 
disease and other dementias. Without this essential family support, these individuals would 
require nursing home care, which is not what they or their families want, and certainly would add 
enormous cost to an already strained system. 

Health care currently focuses on encouraging patients and families to become more “engaged,” 
“activated,” and “self-reliant” in care. These efforts, as well as HIPAA itself, assume a 
competent adult patient, able to absorb complicated information and act on it. But many of the 
patients most at risk for poor outcomes and hospital readmissions — older adults with multiple 
chronic conditions, including cognitive deficits — are not able to become actively engaged. 
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Several studies have demonstrated that hospital patients do not remember or do not understand 
the medications they are supposed to take at home. In one study patients younger than 65 were 
unable to name 60% of their medications, and people over 65 could not remember 88% of these 
medications." Recently discharged patients rely on a family member or friend to help them at 
home and to manage or provide follow-up care. 

Recently doctors have described a “post-hospital syndrome,” ^ a condition family carergivers 
know well. Even in ordinarily healthy and competent people, the experience of hospitalization 
itself, particularly a stay in an ICU, can create temporary lapses in cognitive tunction and 
independence. For elderly people who are already frail or confused, the problem is even worse. 
Dr. Peter Provonost of Johns Hopkins University says, “Patients in this state of mind are in no 
condition to understand discharge instructions such as how to keep wounds clean or when to take 
medications. It’s easy to see how the patient can quickly decline.” “* Yet hospital staff continue 
to say to a family caregiver, “I explained everything to your mother. Just ask her what to do.” 

For 17 years I was one of this army of invisible family caregivers. I took care of my late 
husband, who had a traumatic brain injury and was quadriplegic, at home. And for the past 1 5 
years 1 have directed the Families and Health Care Project at the United Hospital Fund, a 
nonprofit health services research and philanthropic organization. We work to raise awareness 
among policy makers, health care professionals, and regulators about the importance of training 
and supporting family caregivers who take on this daunting challenge. To help family caregivers 
and health care providers work more closely in partnerships, we created a website - 
wwww.nextstepincare.org. The website is home to 25 guides for family caregivers in English, 
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Spanish, Chinese, and Russian, and a robust complement of guides for providers. The guides to 
HIPAA were among the first on the website and in recent months they have become the most 
frequently downloaded. ^ 1 think that says something about the level of confusion that exists in 
the public and among health care providers as well. 

In 2012 the United Hospital Fund and the AARP Public Policy Institute collaborated on a 
national survey of family caregivers to determine the extent of the medical/nursing tasks they 
perform, how they learn to do these tasks, and who helps them. * We found that nearly half 
(46%) of family caregivers were doing one or more medical/nursing tasks (defined as medication 
management of various kinds, wound care, monitoring medical equipment, or similarly 
demanding tasks), in addition to the personal care and household chores more usually associated 
with family caregiving. When asked who taught them, these caregivers typically responded, “I 
learned on my own.” Yet their family members, most of whom had multiple chronic conditions, 
had been to hospital ERs or had been admitted to the hospital, sometimes more than once, in the 
previous year. And when we asked who else helped at home, the answer again typically was, 
“No one.” Family caregivers arrange doctor appointments, transportation, supplies, and other 
necessities. In effect, they are care managers without portfolio. You can see why we titled the 
survey report, “Home Alone: Family Caregivers Providing Complex Care.” 

We did not specifically ask about HIPAA in this survey. But in my work I hear regularly from 
family caregivers all over the country who tell me their stories about being shut out of important 
discussions about their ill family member and about feeling helpless and terrified when they get 
home and realize that they don’t know what to do to take care of their relative. When I talk to 
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groups of caregivers and professionals, I often ask if anyone has had an experience with HIPAA. 
Invariably many hands are raised, and heads nod in agreement. I particularly remember one 
family caregiver, a big, burly detective who takes care of his father. He said, “It’s my job to get 
information from people who don’t want to talk to me. But when I come to the hospital and ask 
about my dad, I can’t get anyone to tell me what’s going on.” If he couldn’t jump over the 
HIPAA barrier, what chance do the rest of us, lacking his confidence and skills of persuasion, 
have? 

My HIPAA Experience 

In my previous professional experience, I worked at The Hastings Center, a bioethics institute, 
and was active in advocating for strict confidentiality protections for people with HIV/AIDS who 
often suffered loss of housing, employment, and benefits because of unauthorized disclosures of 
their diagnosis. So it is with some chagrin that 1 recently found myself on the wrong side of the 
privacy law. My sister, who was in severe abdominal pain, asked me to accompany her to the 
Emergency Room of a major New York City medical center. We waited and waited and finally 
a triage nurse told my sister to follow her into a room. I got up to join her, but the nurse stood in 
my way, saying, “You can’t come with her. It’s a HIPAA rule.” My sister said, “But I want her 
with me.” No way. I should have insisted but I had learned from my long experience with my 
late husband that a family member who raises questions or challenges a nurse quickly gets 
labeled as a pest or an even nastier epithet, and 1 did not want to jeopardize my sister’s care. 

(She recovered and is fine, despite two very unpleasant days on a gurney in the ER corridor.) 


Why Did We Need HIPAA in the First Place? 
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Before HIPAA, confidentiality of medical information was covered by a patchwork of state laws 
and regulations that sometimes conflicted and certainly confused practitioners as well as patients. 
HIPAA was primarily intended to give workers and their families the right to transfer their health 
care insurance from one job to another without penalties and to simplify administrative processes 
in transmitting information, especially electronically. The privacy provision was included as the 
final section of the law, although it has come to be its most familiar segment. 

The Privacy Rule, finalized in 2003 and revised several times since then, was intended to sort out 
these problems and give providers clear direction. In 2009, as part of the American Recovery and 
Reinvestment Act (ARRA), the expansion of health information technology was included as the 
Health Information Technology for Clinical and Economic Health Act (HITECH). This act 
significantly increased the enforcement provisions of HIPAA, especially around security and 
transfer of electronic personal health information. 

The “HIPAA Scare” and Enforcement 

In many institutions, however, HIPAA was introduced by lawyers and risk managers who 
stressed the legal and financial consequences of failing to comply with regulations. Regardless of 
the trainers’ intent, staff members who attended these sessions clearly heard the message, “If you 
want to be safe, don’t tell anyone anything.” One professional in the United Hospital Fund’s 
Transitions in Care Quality Improvement Collaborative remarked that in her organization, even 
asking a patient if a family member helps him at home is considered a HIPAA violation. 

This training was not so much about protecting patients as protecting oneself and the 
institution. The result was what has been called the “HIPAA scare,” a situation in which even 
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patients were not given information about their condition because of fears that the nurse or 
doctor would get into trouble. (Patients’ inability to access their own information is the third 
most common problem reported to the United States Department of Health and Human Services’ 
Office of Civil Rights.) That fear has been passed on to new employees who may trust what they 
learn through informal communication more than what they are told in formal trainings. 

At the same time, fears have been reinforced by reports that institutions have been fined and 
employees censured or fired because of HIPAA violations. The most publicized violations have 
been failures to protect large amounts of data, not unwarranted disclosures of an individual 
patient’s information. After a year-long examination of cybersecurity and vulnerability to 
hackers, the Washington Post concluded that health care is among the most vulnerable industries 
in the country, in part because of aging technology and failures to fix known software flaws. 

Fears that an individual doctor or nurse can be sued for disclosing information are common but 
exaggerated. An individual who believes that protected health information has been 
inappropriately disclosed has no legal recourse under HIPAA other than a complaint to the 
Office of Civil Rights. Although HIPAA creates a right to privacy, there is no right to sue a 
doctor, nurse, or hospital. The individual can file a lawsuit under state law alleging violation of 
privacy, and would bear the burden of proving harm, but HIPAA would not be a factor. State 
investigations can, however, result in fines. Some of the HIPAA violations that have resulted in 
staff being fired relate to theft of social security numbers or credit care numbers, which were 
crimes before HIPAA. Other violations have involved staff checking out their neighbors or ex- 
spouses information or a celebrity’s data. These are bad enough but they should not be confused 



with a daughter’s justifiable desire to know what kind of follow-up care her mother will need, 
especially if she is going to be the one expected to provide it. With increasing attention under 
HITECH to breaches of confidentiality and increased penalties, it is possible that a new 
“HITECH scare” may emerge. While there is ample reason for concern about lax security, it 
would be unfortunate if this new wave of compliance anxiety overshadowed basic principles of 
communication and good clinical care. 

HIPAA’S Chilling Effect on Communication 

While fears of being sued or fined are certainly prevalent, in my opinion the overriding reason 
HIPAA is used to cut off communication is that it serves as a convenient excuse not to talk to 
families or listen to what they know about the patient. If families are kept at arm’s length, the 
easier it is to avoid difficult conversations about prognosis or treatment options. With some 
exceptions, health care professionals are not well trained in or skilled at communicating with lay 
people — patients first of all but even more so their families. Families are welcomed in marketing 
material, not so much in hospital rooms. 

Part of the reason HIPAA has been so misunderstood and misused is that it fits neatly into an 
already well established pattern of keeping family caregivers at arm’s length. Families ask 
questions. They want answers. If they are doing their job, they are good advocates for their 
family members. A law that limits sharing information offers a convenient but misguided 
rationale for withholding information. 
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Health care providers, schooled not only in HIPAA law but also in patient autonomy, sometimes 
make assumptions about patients’ concerns over privacy. In fact, most patients want — and 
need — ^the support and understanding of the key people in their lives. Almost four in five 
respondents in a recent study of over 1 8,000 veterans were willing to share access to their 
electronic health records with family members and other nonprofessionals. ’ Social support is 
clearly an important element in managing chronic illnesses, and it is difficult for family and 
friends intimately involved with the patient’s care to provide that support without relevant 
information. 

As I noted, there are certainly cases in which a patient adamantly refuses to have information 
shared with some or all family members. The reasons may be varied. For example, a relative 
long out of the family picture shows up unexpectedly and demands information about the 
patient’s condition. Or the patient has had a long history of conflict with a particular family 
member and does not want to share any information. In our experience working with over 40 
health care organizations in New York City, however, we find that the most common reason is 
not related to privacy at all but to a desire not to burden a family member with responsibilities. 

“I don’t want my daughter to worry about me. 1 will be fine on my own.” Understandable but 
unrealistic and ultimately self-defeating. These cases require negotiation, especially if the family 
member is going to be responsible for follow-up care. At the same time health care providers 
should not agree to withhold vital information from the patient at the family’s request unless the 
patient has asked not to be informed. Establishing rules for communication are important and 
are best accomplished at the outset of care. 
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Recommendations 

• OCR should reinforce to health care providers the provision in HIPAA that permits 
disclosure of relevant protected patient information to family caregivers or others who are 
going to be responsible for providing, managing, or paying for a patient’s care. 

• As part of its Conditions of Participation, the Centers for Medicare and Medicaid 
Services (CMS) should encourage hospitals and other covered entities to convene a group 
of senior leaders and staff to review relevant elements of the organization’s privacy 
policies and practices. This should include general information about HIPAA 
compliance but also any specific practices that deviate from the general rules (requiring 
written consent, for example, for disclosures to family members). It should also include 
information about the protections in place to protect the security of data collected and 
stored in an electronic health record. 

• Staff should be trained (or retrained) on HIPAA and HITECH so that all understand the 
same principles and rules. As a practical matter, it helps to have one or two family 
members be designated to receive updates and to avoid giving information over the 
telephone to unfamiliar people. 

• CMS should encourage health care organizations to create a simple statement of the 
organization’s policy and practices that patients and family can understand. Patients are 
required to sign a legal disclaimer that they have been informed about the organization’s 
policies, but these are usually written in language that only health care lawyers can 
understand. Instead of giving patients confident that their information will be protected 
from theft and misuse, these statements usually describe the many ways in which the 
organization can use the patient’s information. 
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Thank you for your attention and 1 will be glad to answer any questions. 


' Feinberg, L., Reinhard, S.D., Houser, A., and Choula, R. Valuing the Invaluable: 201 1 Update. 
The Growing Contributions and Costs of Family Caregiving. Washington: AARP Public Policy 
Institute, available at httD://assets.aarD.org/rgcenter/ppi/ltc/i5 1 -caregiving.pdf 

^ Science Daily, December 10, 2012. 

http://www.sciencedailv.eom/releases/2009/l 2/09 1 2 1 0000845.htm 

^ Krumholz, H.M. Post-hospital syndrome — an acquired transient condition of generalized risk. 
New England Journal of Medicine inn 10 2013; 368(2): 100-102. 

^ Quoted in http://www.usatodav.eom/storv/news/nation/20l3/01/22/patients-post-hospital- 
svndrome/1853813/ 

^ http://www.nextstepincare.org/Caregiver Home/HIPAA/ 

http://www.nextstepincare.org/next step in care guides/21 /Provider HIPAA/English 


* Reinhard, S.C., Levine, C., and Samis, S. Home Alone: Family Caregivers Providing Complex 
Care. Washington and New York: AARP Public Policy Institute and United Hospital Fund, 
2012. Available at: http://www.uhfnvc.org/publications/880853 

’ Zulman, D.M., Nazi, K.M., Turvey, C.L., et al. 2011. Patient interest in sharing personal health 
record information. Annals of Internal Medicine 155:805-810. 
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Mr. Murphy. Thank you, and Mr. Wolfe, you are recognized for 
5 minutes. 


TESTIMONY OF GREGG WOLFE 

Mr. Wolfe. Good morning. Chairman Murphy and members of 
the Oversight Committee. My name is Gregg Wolfe, CEO of 
Kaplan, Leaman, and Wolfe Court Reporting and Litigation Sup- 
port and Federal Official Court Reporter for the Eastern District of 
Pennsylvania. 

I am very thankful for the invitation extended to me so that I 
may testify to address the necessary and dire need to change the 
HIPAA law regarding minors and legally emancipated adults who 
either have a mental disorder, disability, or drug and/or alcohol ad- 
diction. I will set forth the reasoning for the exception to our valu- 
able HIPAA law, which will have a positive impact on our society. 

My son, Justin, was a gregarious, affectionate, caring, compas- 
sionate, and intelligent young man whose life came to a sudden end 
on December 19, 2012, from a heroin overdose at the very young 
age of 21. 

Justin had attended Drexel and Syracuse Universities for his 
freshman and sophomore years respectively, carried a 3.0 CPA, but 
each year ended poorly due to aberrant behavior. Justin had been 
seeing therapists since he was 15 V 2 due to anxiety, OCD, and 
ADHD. 

He was placed on Adderall when he was almost 17 years old. Un- 
like physical illness, mental illness has a much longer maturation 
and duration until one discovers the effects and results with which 
to treat and possibly cure. 

In 2012, Justin told his mother that he was addicted to Percocets 
and Oxycontin. She, in turn, took him to our primary care physi- 
cian without my knowledge, per Justin’s request. At that time, Jus- 
tin apprised the doctor of his addiction, but also, when his mother 
was not present in the room, he stated that he had been using her- 
oin for a few months prior to that date. 

Justin had asked that I not be apprised of any of those sub- 
stances and did not want his mother being informed of his heroin 
usage. Without the heroin usage, the doctor expressed dire concern 
to Justin’s mother and told her to take him immediately to a rec- 
ommended crisis center for treatment. However, upon departing 
the office, Justin convinced his mother, through his drug-manipula- 
tive behavior, to take him instead to a Suboxone doctor he knew 
of, which she did. 

Justin would not allow his mother into the treatment room. 
There Justin admitted to using heroin for the previous year, and 
he was prescribed Suboxone. 

Two months later, against Justin’s wishes, I was only informed 
of his Percocet addiction and implored him to enter into drug reha- 
bilitation treatment. Justin was working two jobs during this time, 
with little time to attend treatment. Additionally, he convinced his 
mother and I the Suboxone was helping him with his recovery. 

As another month passed, Justin was residing in his college 
apartment, and he finally hit rock bottom. We finally gave him an 
ultimatum, and he entered intensive outpatient treatment for 5 
weeks that summer. Once in rehab, I contacted the intake director 
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to inquire about his progress. I was informed that he could not dis- 
close any information under the HIPAA regulations. I was ex- 
tremely frustrated as I could not be apprised of my son’s condition. 

During Justin’s 5-week rehabilitation, I sent him to see an expe- 
rienced psychiatrist weekly, which ensued until his ultimate de- 
mise this past December. I explained to the psychiatrist his history 
with abuse, for which he tried to counsel Justin, as well as to pre- 
scribe medication for his depression, anxiety, and OCD. I later 
learned, however, upon Justin’s passing, that he had not disclosed 
his heroin addiction to the psychiatrist, except to say that he had 
tried it once. 

Upon Justin’s passing, his depression and OCD medication were 
found untouched in his apartment. Oddly, he continued to take his 
anxiety medication. Justin returned to school last fall at Temple 
University where he appeared to be doing well. He even joined 
AEPI, a wonderful fraternity, where he pledged and was fully sup- 
ported by the brotherhood. 

However, Justin obviously was terribly and secretly addicted to 
heroin, in addition to having mental disorders. He died of an acci- 
dental heroin overdose just a few weeks later. 

Though doctors knew since May, 2011, no one in our family was 
aware that Justin was using heroin, a lethal and insidious drug. 
Everyone was in shock and disbelief when we found out. Neverthe- 
less, it was too late. 

I have confronted numerous parents, and nine out of ten people 
are not aware that snorting heroin is an option, which is how Jus- 
tin used the drug, not by injection. Most are also shocked to learn 
that heroin is only $5 to $10 a bag. 

It was alarming to learn that it is actually cheaper to buy a bag 
of heroin on the street than it is to purchase Percocet and 
Oxycontin. Even kids from affluent suburban neighborhoods like 
my son traveled to dangerous places like Camden, NJ, and North 
Philadelphia in Pennsylvania to buy drugs. Justin sold some of his 
personal belongings and items stolen from his mother, pawned his 
computer on several occasions, and actually sold his Suboxone and 
Adderall medication, which I learned after the fact by reading his 
text messages. 

I hereby request an exception be added to HIPAA allowing par- 
ents of minors with a mental disorder or addiction, who maintain 
legal residency in their parents’ homes, living under the auspices 
of their parents’ care, and who are under their parents’ health in- 
surance coverage as specified by President Obama, until the age of 
26, access to that minor’s medical records for the following reason: 
prevention of harm to individuals and to society. 

One. Any type of addiction or mental disorder can be life threat- 
ening to not only one’s self but to society as a whole as indicative 
of the Newtown Massacres, Columbine, the Aurora shootings, to 
name just a few. 

Justin was non-violent and would never intentionally hurt a soul, 
but unintentionally his life cut short destroyed other lives including 
his younger brother, Austin, who is a Type 1 diabetic, not to men- 
tion the individuals to whom he sold his Suboxone and Adderall. 
After Justin’s passing, Austin told us of his reckless disregard 
when driving as well as when conducting some of his activities. 
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Thank God he never hurt anyone on the road. I have pictures of 
Justin’s apartment from his last months that demonstrate how he 
resided at college, including cigarette burns in his bedding from ob- 
viously nodding out, which could have set the apartment complex 
ablaze, resulting in injury or death to himself and others. 

Two. Justin’s stepfather had taken him assault rifle target shoot- 
ing on occasion for sport. Had we known about his heroin addic- 
tion, he would not have armed him. Justin had often asked my per- 
mission to become licensed to buy a gun, which I was against de- 
spite not knowing about his addiction. However, I am forever 
thankful for not allowing it, especially now that I know he was 
using a mind-bending drug. 

Mr. Murphy. Mr. Wolfe, I know — we are out of time. Can you 
give a final summary, and we can have you come back to that ele- 
ment two? Is there a final summary you can give to your statement 
there? 

Mr. Wolfe. I do. I have some very important points to make, 
and it will only take 3 or 4 more minutes. 

Mr. Murphy. I will give you an additional minute. Go ahead. 

Mr. Wolfe. Thank you. 

Three. Justin’s lying and manipulation was the result of his her- 
oin addiction. I have learned that heroin rewires the synapses of 
the brain so the only way to experience pleasure is by doing more 
of the drug. One becomes numb to all other surroundings, emo- 
tions, and empathy, thereby resulting in the aforementioned behav- 
ior. 

Drug-related deaths have risen steadily over the last 11 years ac- 
cording to a study from the Center for Disease Control. In 2010, 
drug overdoses killed 38,000 people, making drugs a more common 
cause of death than car accidents, guns, or alcohol. By comparison, 
approximately 8,500 homicides were the result of firearms. 

According to a 2011, article in Psychology Today, accidental drug 
overdosing is the second most cause of death of young people in the 
U.S., exceeding attributable to firearms, homicides, or HIV AIDS. 

According to the U.S. Department of Health and Human Serv- 
ices, “With an immature prefrontal cortex, which does not develop 
until 24 to 25 years old, even if teens understand that something 
is dangerous, they may still go ahead and engage in risky behavior. 
With young adults not having their frontage cortex fully developed, 
those with mental disorders and or addictions exacerbate the irra- 
tional behavior.” 

In many circumstances, parents know what is best for their chil- 
dren, especially if given the appropriate medical information with 
which to exercise judgment and guidance. In an effort to help other 
parents in similar situations, I have launched an all-out campaign 
to the media. President Obama, lawmakers in New Jersey, Penn- 
sylvania, and Delaware, and Congressional leaders such as your- 
selves to call attention to this issue, and to lobby for adding addi- 
tional language to HIPAA that may help protect troubled young 
adults and their communities from harm. 

Parents are unable to operate effectively in a vacuum, without 
knowledge by healthcare professionals about our drug-induced, or 
mentally disabled, legally-aged children who do not have the 
wherewithal to reason or think rationally for themselves. The ah- 
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sence of rationale may result in life-threatening decisions or, as in 
my son’s case, premature death. 

HIPAA has exceptions for public health and safety built-in. Item 
number five under Permitted Uses and Disclosures whereby pro- 
tected health information can be disclosed without an individual’s 
consent, including serious threat to Health or Safety. Covered enti- 
ties may disclose protected health information that they believe is 
necessary to prevent or lessen a serious and imminent threat to a 
person or the public, when such disclosure is made to someone they 
believe can prevent or lessen the threat, including the target of the 
threat.” So it should stand to reason language addressing this par- 
ticular safety hazard is prudent and necessary. 

In closing, I am hereby requesting the following language be 
added to this HIPAA exception to avoid ambiguity. Parents or legal 
caretakers of a minor and/or emancipated adult with documented 
drug abuse and/or mental health histories, who continue to cover 
the minor and/or emancipated adult with health coverage, and/or 
continue to support the individual financially, will have access to 
that individual’s healthcare records until the age of 26 to prevent 
him/her or society from harm. 

Although Justin’s family, friends, nor Justin himself, could not 
save him, it is my hope that with change Justin’s situation can 
help save millions of young lives in the future. Addiction and men- 
tal disabilities wreak havoc on our society and affect all ethnicities 
and socioeconomic backgrounds. 

When you look at all the famous and intelligent people whose 
lives were tragically taken due to mental disturbances and drug 
abuse, this country has lost a wealth of talent and success which 
would have been an asset to the growth and strength of our Na- 
tion. 

Thank you very much. 

[The prepared statement of Mr. Wolfe follows:] 
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Gregg B. Wolfe, RPR, CM 



Good Morning, Chairman Murphy, Vice Chairman Burgess, Ranking Member DeGette 
and Members of the Oversight and Investigations Subcommittee. My name is Gregg 
Wolfe, CEO of Kaplan, Leaman & Wolfe Court Reporting & Litigation Support and 
Federal Official Court Reporter for the Eastern District of Pennsylvania. 

I am very thankful for the invitation extended to me so that I may testify to address the 
necessary and dire need to change the HIPAA law regarding minors and legally 
emancipated adults who either have a mental disorder, disability or drug and/or alcohol 
addiction. I will set forth the reasoning for the exception to our valuable HIPAA law, 
which will have a positive impact on our society. 

My son, Justin, was a gregarious, affectionate, caring, compassionate and intelligent 
young man whose life came to a sudden end on December 19, 2012 from a heroin 
overdose at the very young age of 2 1 . 

Justin had attended Drexel and Syracuse Universities for his freshman and sophomore 
years respectively, carried a 3.0 GPA, but each year ended poorly due to aberrant 
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behavior. Justin had been seeing therapists since he was 15 and a half due to anxiety, 
OCD and ADHD. 


He was placed on Adderall when he was almost 17 years old. Unlike physical illness, 
mental illness has a much longer maturation and duration until one discovers the effects 
and results with which to treat and possibly cure. 

In 2012, Justin told his mother that he was addicted to Percocets and Oxycontin. She, in 
turn, took him to our primary care physician without my knowledge, per Justin’s request. 
At that time, Justin apprised the doctor of his addiction, but also, when his mother was 
not present in the room, that he had been using heroin for a few months prior to that date. 

Justin had asked that I not be apprised of any of those substances, and did not want his 
mother being informed of his heroin usage. Without disclosing the heroin usage, the 
doctor expressed dire concern to Justin’s mother and told her to take him immediately to 
a recommended crisis center for treatment. However, upon departing the office, Justin 
convinced his mother, through his drug-manipulative behavior, to take him instead to a 
Suboxone doctor he knew of, which she did. 

Justin would not allow his mother into the treatment room. There, Justin admitted to 
using heroin for the previous year, and he was prescribed Suboxone. 
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Two months later, against Justin’s wishes, I was informed ONLY of his Percocet 
addiction, and implored him to enter into drug rehabilitation treatment. Justin was 
working two jobs during this time, with little time to attend treatment, Additionally, he 
convinced his mother and I the Suboxone was helping him with his recovery. 

As another month had passed. Justin was residing in his college apartment and he finally 
hit rock bottom. We finally gave him an ultimatum and he entered Intensive Outpatient 
Treatment for five weeks that summer. Once in rehab, I contacted the intake director to 
inquire about his progress. I was informed that he could not disclose any information 
under the HIPAA regulations. I was extremely frustrated as I could not be apprised of mv 
son’s condition. 


During Justin’s 5-week rehabilitation, I sent him to see an experienced psychiatrist 
weekly, which ensued until his ultimate demise this past December. I explained to the 
psychiatrist his history with abuse, for which he tried to counsel Justin, as well as to 
prescribe medication for his depression, anxiety and OCD. I later learned, however, upon 
Justin’s passing, that he had not disclosed his heroin addiction to the psychiatrist, except 
to say that he had tried it once. 

Upon Justin’s passing, his depression and OCD medication were found untouched in his 
apartment. Oddly, he continued to take his anxiety medication. Justin returned to school 
last fall at Temple University where he appeared to be doing well. He even joined AEPI, 
a wonderful fraternity, where he pledged and was fully supported by the brotherhood. 
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However, Justin obviously was terribly and secretly addicted to heroin, in addition to 
having mental disorders. He died of an accidental heroin overdose just a few weeks later. 

Though doctors knew since May 201 1, no one in our family was aware that Justin was 
using heroin, a lethal and insidious drug. Everyone was in shock and disbelief when we 
found out. Nevertheless, it was too late. 

I have confronted numerous parents, and nine out of ten people are not aware that 
snorting heroin is an option, which is how Justin used the drug, not by injection. Most 
are also shocked to learn that heroin is only 5-10 dollars a bag. 

It was alarming to learn that it is actually cheaper to buy a bag of heroin on the street than 
it is to purchase Percocet or Oxycontin. Even kids from affluent suburban neighborhoods 
like my son traveled to dangerous places like Camden, NJ and North Philadelphia, PA to 
buy drugs. Justin sold some of his personal belongings and items stolen from his mother, 
pawned his computer on several occasions, and actualy sold his Suboxone and Adderall 
medication, which I learned after the fact by reading his text messages. 

I hereby request an exception be added to HLPAA allowing parents of minors with a 
mental disorder or addiction, who maintain legal residency in their parents’ homes, living 
under the auspices of their parents’ care, and who are under their parents’ health 
insurance coverage as specified by President Obama, until the age of 26, access to that 
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minor's medical records for the following reason — PREVENTION OF HARM TO 
INDIVIDUALS AND TO SOCIETY. 


1 . Any type of addiction or mental disorder can be life-threatening to not only one’s 
self, but to society as a whole, as indicative of the Newtown Massacres, 
Columbine, the Aurora shootings, to name just a few. 

Justin was non-violent and would never intentionally hurt a soul. But, 
unintentionally, his life cut short destroyed other lives including his younger 
brother, Austin, not to mention the individuals to whom he sold his Suboxone and 
Adderall. After Justin’s passing, Austin told us of his reckless disregard when 
driving as well as when conducting some of his activities. Thank God he never 
hurt anyone on the road. I have pictures of Justin’s apartment from his last months 
that demonstrate how he resided at college, including cigarette bums in his 
bedding from obviously nodding out which could have set the apartment complex 
ablaze, resulting in injury or death to himself and others. 

2. Justin’s stepfather had taken him target shooting on occasion for sport. Had we 
known about his heroin addiction, he would not have armed him. Justin often 
asked my permission to become licensed to buy a gun, which I was against 
despite not knowing about his addiction. However, I am forever thankful for not 
allowing it, especially now that I know he was using a mind-bending drug. 
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3. Justin’s lying and manipulation was the result of his heroin addiction. I have 
learned that heroin rewires the synapses of the brain so the only way to experience 
pleasure is by doing more of the drug. One becomes numb to all other 
surroundings, emotions and empathy, thereby resulting in the aforementioned 
behavior. 

4. Drug-related deaths have risen steadily over the last 1 1 years, according to a study 
from the Center for Disease Control. In 2010, drug overdoses killed 38,329 
people, making drugs a more common cause of death than car accidents, guns or 
alcohol. By comparison, approximately 8,500 homicides were the 

result of firearms. 

5. According to a 20 1 1 article in “Psychology Today,” accidental drug overdosing is 
the second most cause of death of young people in the US, exceeding those 
attributable to firearms, homicides or HIV/AIDS. 

6. According to the U.S. Department of Health & Human Services, “With an 
immature prefrontal cortex, which does not develop until 24-25 years old, even if 
teens understand that something is dangerous, they may still go ahead and engage 
in risky behavior.” With young adults not having their frontal cortex fully 
developed, those with mental disorders and/or addictions exacerbate the irrational 
behavior. 
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In many circumstances, parents know what’s best for their children, especially if given 
the appropriate medical information with which to exercise judgment and guidance. In an 
effort to help other parents in similar situations, I have launched an all-out campaign to 
the media, President Obama, lawmakers in NJ, PA and DE, and congressional leaders 
such as yourselves to call attention to this issue, and to lobby for adding language to 
HIPAA that may help protect troubled young adults ~ and their communities — from 
harm. 

Parents are unable to operate effectively in a vacuum, without knowledge by healthcare 
professionals about our drug-induced, or mentally disabled, legally aged children who do 
not have the wherewithal to reason or think rationally for themselves. The absence of 
rationale may result in life-threatening decisions or, as in my son’s case, premature death. 

HIPAA has exceptions for public health and safety built-in. Item #5 under “Permitted 
Uses and Disclosures” whereby protected health information can be disclosed without an 
individual’s consent, including, “Serious threat to Health or Safety. Covered entities may 
disclose protected health information that they believe is necessary to prevent or lessen a 
serious and imminent threat to a person or the public, when such disclosure is made to 
someone they believe can prevent or lessen the threat, including the target of the threat.” 
So, it should stand to reason language addressing this particular safety hazard is prudent 
and necessary. 
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In, closing, I am hereby requesting the following language be added to this HIPAA 
exception to avoid ambiguity. Parents or legal caretakers of a minor and/or 
emancipated adult with documented drug abuse and/or mental health histories, who 
continue to cover the minor and/or emancipated adult with health coverage, and/or 
continue to support the individual financially, will have access to that individual’s 
healthcare records until the age of 26 to prevent him/her or society from harm. 

Although Justin’s family, friends, nor Justin himself, could not save him, it is my hope 
that with change Justin’s situation can help save millions of young lives in the future. 
Addiction and mental disabilities wreak havoc on our society and affect all ethnicities 
and socioeconomic backgrounds. 

When you look at all the famous and intelligent people whose lives were tragically taken 
due to mental disturbances and drug abuse, this country has lost a wealth of talent and 
success which would have been an asset to the growth and strength of our nation. 
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Mr. Murphy. Thank you. Mr. Kelley, you are recognized for 5 
minutes. Mr. Kelley. 

TESTIMONY OF EDWARD KELLEY 

Mr. Kelley. Thank you, Mr. Chairman. I am a father of a para- 
noid schizophrenic son. He was diagnosed at age 14, which means 
for half his life he has had this illness, and I am afraid I have some 
rather harsh news and some points to make that are going to fall 
in line, and I thank Congressman Cassidy for his comments be- 
cause he really gets right to the point. 

My wife and I, upon learning of this diagnosis, embarked upon 
educating ourselves in every aspect of mental health treatment, in- 
cluding navigating the system, familiarizing ourselves with all the 
things that are in our way, and then we took upon ourselves to go 
out and educate others, and we have done that by teaching classes, 
we have done that by serving on boards, we have done that at 
speaking engagements, we have done it by raising money, and we 
have also done it by bringing people into our home and comforting 
them and helping them to cope. 

And so what I am going to tell you is that we are actually 
ashamed of ourselves as to what we did not know before our son 
became mentally ill, and I would dare say that if the members of 
this committee were to spend a couple of days with someone with 
psychosis, this would fly. You would change things tomorrow. 

And so what needs to happen is there needs to be recognition 
that there is a gaping hole, and I want to clarify something. There 
is a difference between anosognosia, which is lack of insight, and 
a psychotic episode. They are two entirely different things. 
Anosognosia can last for long, long periods of time and lack of in- 
sight, and you refuse treatment, and you don’t want anybody to 
help you of any kind, most importantly your family members. Not 
just parents. Brothers, sisters, grandparents. 

And so what happens is, you are setting a stage for tragedy, lit- 
erally propping it up because there is this gaping hole we are try- 
ing to teach or trying to address the needs of the severely mentally 
ill the same way we are the mainstream mentally ill population, 
and it doesn’t work. It is illogical. 

My son has thought he has been a U.S. marshal looking for his 
gun. He has thought the aliens were invading him. He thought he 
was a secret agent. He thinks to this day he served in two Iraq 
wars. He has been naked in the snow. He has lived homeless under 
a bridge. He thinks my wife is a stripper and a prostitute and that 
I am a sexual predator. For an entire year he did not believe that 
we were his parents. Now, you tell me that this individual can pos- 
sibly make responsible decisions about his care. 

But when he gets into the hospital, and that is a big if because 
sometimes we don’t have the recent history from prior hospitaliza- 
tions to give the new hospital. By the way, he has been in 14 — for 
14 years he has been in eight hospitals in four counties and one 
city dozens of different times. And so you have this broken chain 
of treatment. 

So imagine a medical system where physicians and treatment 
providers can’t rely on prior history to treat this person. It is be- 
yond comprehension, and the other thing that happens is it stifles 
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accountability, and now, when I tell you that people hide behind 
HIPAA, I am a 14-year-educated man that has been in every situa- 
tion possible, and it is only the grace of God and I think there is 
a plan out there for my wife and I to somehow make a difference, 
that we are sitting here and that our son hasn’t killed himself. He 
is far more likely to kill himself than he is to live the rest of his 
life with his illness. 

And so what we find is that once he gets in the hospital, treat- 
ment can be delayed or not done at all, and I want to cite this ex- 
ample. Our son escaped from a mental health facility that was 
locked. HIPAA was thrown out the window. The hospital was call- 
ing us, the police were calling us, they were trying to pry into his 
bank records. Every privacy violation you can imagine was enacted 
to try to do this manhunt for my son. They found him 4 days later. 
They dragged him into a state hospital in shackles so we can talk 
about stigma later. Once he was in there he verbally assaulted the 
Administrative Hearing Judge, he was put on suicide watch, he 
was completely out of it, and when the time came for his hearing 
to see whether he should receive treatment, we were precluded 
from participating because of HIPAA, and that panel looked me in 
the eye afterwards and said, we can’t do it. Our hands are tied. 

Two days later a patient was — a staff member was killed in his 
wing. We don’t even want to know what happened, but this is what 
did happen. He was 1 year, 1 year in that facility. The abuse, the 
things that happened to him in that hospital and they never, ever 
let us in. When he was 18, they couldn’t live without us. When he 
became 18, we were the enemy. We might as well have been 
strangers on the street. We have doctors who have shared with us 
behind the scenes some things that they knew they were going to 
get in trouble with. They told us, we can lose our jobs, but we have 
to tell you. We are members of community, and people know us, 
so people took chances, but when we got outside of our community, 
there were no changes being taken, and we were left out. 

The other thing that happens is imagine somebody who is men- 
tally ill being discharged back into real society. Even under the 
best plans with families being involved, it is a very difficult proc- 
ess. But take a look at someone who is not part of a discharge plan 
that includes a support network. Our son has been released and 
sent on buses, and we haven’t found him for weeks, wondering if 
he is dead. 

HIPAA empowers homelessness. Our son has been gone. No 
money, no clothes that are adequate, nothing. Gone. We look 
around in shelters. Gone. We say why didn’t you tell us? We can’t. 
HIPAA precludes that. And we say, we thought — and then this 
whole idea, this notion that they have to tell us if it is a threat to 
us. Well, they are not supposed to let him out if they are a threat. 
So they have already decided he is not a threat, so they won’t let 
us do it. 

So we search for him, the shelters can’t tell that they are there, 
and then the next thing that happens is this person who has been 
released, you don’t want this person released like this. No support, 
isolated, in fear, frustrated, angry, and we are his first target. 
Right? We are the first target. 
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And so people are being released every day without discharge 
plans involving the family, and they have no way to transition back 
into life, and you don’t want that. You don’t want somebody that 
has psychosis as a symptom that pops up, and by the way, this 
idea of anticipating and predicting when imminent danger is com- 
ing, I just fought in the State of Maryland for 4 months to try to 
get that across. Not one person on this planet can predict the tip- 
ping point of someone with a severe mental illness. You can’t do 
it. 

So what you try to do is you rely on who? You rely on the people 
closest to that person, and who is that is the family, but the family 
can’t do it. We can’t give recent history to the next hospital or doc- 
tor because we can’t get it, so what is worse is as each year goes 
by, we have less ability to help. So this idea that we are going to 
provide information to the hospital, it doesn’t work, and it is scary. 

So in closing, I would like to say that HIPAA has a lot of gaping 
holes in it. This is the biggest, but if there are ways to beat 
HIPAA, we seek to find it, which is bad. Our son and other people’s 
sons and parents deserve the right to be collaborative and informed 
so that they are safe and their child is safe. 

Thank you. 

[The prepared statement of Mr. Kelley follows:] 
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APRIL 26, 2013 TESIMONY OF EDWARD F. KELLEY !il 
COMMITTEE ON ENERGY AND COMMERCE 
CONGRESS OF THE UNITED STATES 
HOUSE OF REPRESENTATIVES 

Thank you Mr. Chairman and members of the Committee. 

For background purposes -my wife and ! have been married for nearly 31 years. We have 3 children - 
two sons and a daughter - two of which were blessed with great health; and one - our middle child - our 
other son, born with an illness no one should ever have to endure. Since his diagnosis 14 years ago - 
one of paranoid schizophrenia - my wife and I have sought to become (first) better educated about 
mental illness - particularly severe mental illnesses; and, have sought to navigate the mental health 
system to find ways in which to help our son - and others - improve their lives; and - heip the families 
of others who are ill help their loved ones - and themselves . My wife has been on the Boards of three 
(3) prominent Mental Health Advocacy Organizations: taught classes to help families cope with their 
loved ones' illnesses and how to better navigate the 'system'; and raised monies for these causes. 

Those of us who offer to open up our hearts to you - do not do so without considerable thought and 
apprehension. Not because we are not fully committed to making a difference - but rather because we 
are often at risk for being exploited by what we say; or, those we love are at risk for being harmed by 
our speaking up. This is not easy - and we have taken this chance before - and - in one recent situation 
-my family has been exploited beyond comprehension. At the end of the day, we seek only to help 
educate those in a position to make a difference- o that my family - and millions of others - have hope . 

There is a gaping hole in addressing the needs for the severely mentally ill - and their families. Mental 
Health Reform has helped immensely with improving the availability of care for the mentally ill. But in 
doing so has often addressed the needs for the severely mentally ill in the same manner as that what is 
done for the 80% of those who suffer from mental illness, but are not as ill and/or have far better 
opportunities to recover. The severely mentally ill are far different - and need far different rules - as 
do their families. To not do so is utterly illogical. There are 11 to 12 million people in the US who are 
severely mentally 111. And if you multiply that 'times' the number of people in their family trying to help 
-well the math is staggering as to how many people are affected by this approach. Starting with HIPAA 

To set the stage orooerlv- here are a few items : 

1. For over 14 years our son has been hospitalized dozens of times. 

2. He has been in 8 different hospitals - located in 4 different counties and one city 

3. Since our son turned 18 - he has refused repeatedly to allow hospitals and doctors to disclose 
information to us-whenever he is psychotic-which is normally the reason for his hospitalization 

4. When someone is severely mentally ill - as has been the case with our son - they have an 
impairment of the brain known as 'anosognosia' - which quite simply creates a belief within an 
individual that they are NOT ill. 
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5. With this impairment - our son refuses treatment and refuses to aliow his medical providers to 
speak with us or to provide us with any Information regarding his status or treatment (if any). 

6. We, as parents, try to make contact with his providers, and those providers then ask our son to 
sign a release authorizing them to share our son's condition and treatment. His anger is then 
directed at us for 'daring' to put him In the hospital and wanting 'control over his life'. 

Our family ~ and I believe the families of millions of others who are severely ill - want to take 
responsibility for their loved one{s). But so much stands In the way of American families - and this role 
is already a painful, difficult task. Rather than have the support to help us deal with a situation that is 
already tragic, we are furthered stressed because of laws that cannot possibly have been intended to 
place such a heavy burden on us. We have lost our son to a cruel, horrible mental illness. And each time 
we try to help him recover, we are blocked in so many directions. 

• We have been prevented from getting him timely (or any) treatment because we have no recent 
medical records to support our case. This delay or lack of treatment has horrific consequences 
on our son, Even if our son is hospitalized, we find ourselves begging for the opportunity to help 
him - mostly we cannot. We are not his seen as parents - we are seen as the enemy. 

• HIPAA stifles accountability. Who - if not the family - can make sure our loved one is being 
properly treated or not? We are at the mercy of medical providers who will do as they see fit, 
because they can hide behind HIPAA . Decisions to treat or not treat; decisions on medication; 
having the opportunity to understand the history of our son before treating him; these and 
other important factors are dropped out. Our son Is at risk when we are left out. 

• When our son was under 18, the hospitals and doctors relied immensely on our input and 
involvement. We would spend as much time as they requested or needed - giving them any 
Information we could; and they In return would share with us their diagnosis, treatment plan 
and concerns. At the very least this process gave us assurances that mistakes have the best 
chance of being avoided, or repeated; and, would give us some sense of peace that he was 
being taken care of by people who had a reliable reference point for addressing the matter. 
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• Once our son turned 18, we - his parents - were the enemy. Our son's delusions included a 
belief that HE owned our home - not us. He believed he had served in two (2) wars in Iraq and 
Afghanistan and had been wounded. He believed he had shrapnel in his body from those 
experiences, and that was the cause of his hospitalizations. He often would believe he was a U.S. 
Marshall - or a spy - and that we - his parents - were getting him hospitalized so that he could 
not do his job. He has seen a friend "living" in my wife's eye - and burned his yearbook to get 
that person out of her eye. He has told doctors that I have abused him and that my wife was a 
stripper and prostitute - and that he was traumatized from our actions. He has lived under 
bridges when he had a nice place to live. He has accidently set himself on fire falling asleep with 
a burning cigarette in his hand, on his chest. He has been victimized thru beatings and robbery 
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because he was incapable of protecting himself. He has been naked in the snow for an extensive 
period of time - two times in one day! He Is so ill -yet -since he became 18 -it has been a 
nightmare to help our son. 

With us having access to doctor and hospital records - we could have helped each subsequent 
doctor and staff treat our son - faster and better -or before he was released. Yet -as he is 
moved around from hospital to hospital - 8 In 4 counties and the city of Baltimore -there is no 
way to do this - as we are turned down. 

We have watched our son be given medications that are life damaging - because there is no 
record of what works or does not work. We usually do not know what medication he is being 
given. So his health is in jeopardy. As we look back now -we see a broken chain of 
hospitalizations, psychiatric evaluations and treatments that are unknown. Every hospitalization 
is a new beginning. We have had a judge tell us she will not "institutionalize" our son - when we 
wanted to get him hospitalized - because we did not have current records to prove he needed 
same. We have had doctors tel! us that we cannot participate in med-panel hearings, in the 
hospital, because our son has privacy rights under HIPAA. 

We have not known where our son was; what hospital; when he was released; or what was 
done to him. 

The argument made is that the ill person can be convinced to allow disclosure - and allow the 
families to help the medical providers. Well that Is not the case when someone is severely 
mentally ill - because they cannot because of their illness. 

The argument Is made that the loved ones can give the hospital information. Well - that 
information may need further explanation, but the hospital cannot ask for it. The information 
may lack what happened in several prior hospitalizations, because the hospitals would not 
release anything to the loved ones. In many cases all we knew was he was in the hospital - and 
that was it. It is not working this way. 

We have been told that a hospital can give notice to a family member - when the loved one is to 
be released - if the hospital feels the family members are in danger. Well - the hospital is not 
supposed to release anyone if they feel that person is a danger to themselves or others. How 
does that work? 

Our son was hospitalized; escaped from a locked unit in the hospital; a search ensued for 4 days; 
he was caught and brought to another hospital. He was placed on suicide watch; fired his public 
defender during an administrative hearing; and was completely and utterly delusional. Yet my 
wife and I were not allowed to testify at a med-panel hearing, because of HIPAA laws. He ended 
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up spending 1 year in that State hospital - without proper treatment - because of privacy laws 
and the issues concerning involuntary medication. We were powerless to help. 

• We have called emergency rooms to speak with a doctor - and been told - "we cannot 
acknowledge a person is here in the hospital", ^metlmes a hospital tells us. Other times they 
do not. We sometimes 'get around' the situation by calling the phone In the patients' sitting 
area - as patients answer the phone and use it to make calls - and ask patients if {'name of our 
son') is there. 

• Our son has been released numerous times without our knowledge. He has been placed in a bus 
from a hospital 2 hours away -and gone into Baltimore City -and we could not find him for 
days and days. He has been released and walked out with no money or adequate clothing. We 
have found him in our garage when we thought he was in the hospital. We have laid awake 
countless nights wondering if he was being treated properly; or if he had been released and had 
been beaten, killed or otherwise victimized. 

• Often times neighbors or friends would tell us they saw our son - at varying places - when we 
thought he was being safely treated in the hospital 


Communities and people are affected by lack of proper treatment when we families cannot help their 
loved ones: stress and loss of jobs; damage to the brain of the loved one; damage to the loved one's 
heart or nervous system; homelessness; substance abuse; victimization; abuse; medical condition 
decline; isolation; fear; desperation; suicide. 


And these can, and are. the consequences of not allowing those who want to help their loved ones - 
help their loved ones - because HIPAA says we cannot. 
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EXHIBIT TO TESTIMONY OF EDWARD F. KELLEY III - APRIL 26, 2013 
COMMITTEE ON ENERGY AND COMMERCE 
CONGRESS OF THE UNITED STATES 
HOUSE OF REPRESENTATIVES 


WE HAVE EXPERIENCED ALL OF THESE; 

A. Emergency Room Personnel often times prevents the patient's family from coming into the 
admitting area at the time their loved one is brought in. If the family member brought their 
loved one In, they can be denied going Into the back area with their loved one. If their loved one 
came in to the hospital thru an emergency petition, the family member does not usually 
accompany their loved one. If the loved one came in to the emergency room without the 
family's knowledge, they have to start calling around when/if they suspect something has 
happened. 

B. If you know your loved one was taken to a particular emergency room - and you call to provide 
information you feel is helpful - medication, prior hospitalizations, diagnosis - often the person 
on the other end of the phone says "we cannot acknowledge that any person is or is not in this 
hospital. Our agreeing to take information could be construed as acknowledgement the person 
IS in the hospital." Or -they say they can receive your information, but the family has NO idea 
how or if it is being used; especially given the loved one may deny everything. 

C. No 'system' is available for providers (hospitals) to access the loved one's (patient's) prior 
history of mental health hospitalizations - so 'experiment' can begin with each admission. 

D. When your loved one is in the emergency room - and the family is prevented from contributing 
information - several negative consequences can happen: 

1. Release without treatment. 

2. Provide Inadequate treatment by administering medications that do not work or 
address the symptoms - especially if anger, anxiety, depression, hostility or psychosis 
are masked by the patient or exacerbated with substance use. 

3. Treatment with medications that have already proven to cause harm 
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E. During an Administrative Hearing at the Hospital - assuming you are asked to participate: 

1. Hospital can elect to ignore family's input and, or prevent testifying 

2. Hospital can decide to release the person without understanding the situation more 
clearly - as they do not have adequate information 

3. Hospital can continue to require person to remain in the hospital - but shut out the 
family from helping them properly treat the patient. 

4. Patients can be kept in the hospital for longer periods of time - without any treatment - 
which is so cruel - because the hospital had inadequate information. 
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PAGE 2 - EXHIBIT TO TESTIMONY OF EWARD F. KELLEY HI 
F. Release of Loved One by the Hospital 

1. Hospital can determine to not inform family of the release of the person - if they 
determine the person is not a threat [which they already have (determined the patient 
is not a threat to self or others) If they plan to release the patient. 

2. Family's home is often the place where released person often goes first - and the family 
is not aware of their pending arrival; or may not even be there when their loved one 
arrives. 

3. If the patient goes somewhere else, after their release, they often are homeless and 
vulnerable to attack. 

4. The family can find themselves frantically trying to locate their loved one. 


G. Flaws in the HIPAA System Exist Anyway 

1. If the loved one files with the courts - for his/her release from a hospital in which they 
were involuntarily committed - that filing becomes public record [see at end of this 
Exhibit). 

2. Staff members of the Hospitals sometimes take a personal risk, and tell families 'off the 
record' what is going on - but that employee may have limited information - so the 
family gets part of the message. 

Example A - Hospital would not acknowledge our son was admitted. We found out because a friend of 
ours took a chance and called us privately. Hospital did not accept our offer to provide history, 
medication experience, diagnosis of illness - as our son specifically advised them there was to be no 
contact with us. A few weeks later - that same person called us to say our son may be getting released 
soon - and that the staff there had a conversation debating whether or not to advise us to move to an 
undisclosed location - but decided they could not because of HIPAA taws. 

Example B ~ Our son was admitted involuntarily into a hospital - and the hospital refused to allow us to 

provide testimony and information regarding his prior history, including his hostility towards us. Our 

son escaped that hospital, and was eventually caught by the police [quite a dysfunctional situation - 

hospital felt he was not a danger - so no medication - but once he escaped - four counties and 

Baltimore city searched together for him. [what was interesting is that the police called to ask if we ^ 

knew where he was -but not the hospital!!!! We were spending the night inD.C] He was found after 4 « 

days by the police - and taken to a different hospital - and -despite being on suicide 'watch' - he was 
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deemed to not be a danger to seif or others. When his Med Panel hearing came up - we were not 
allowed to testify due to HiPAA. THEN - when I demanded that 1 felt we had a right to provide 
testimony - they asked me to remain in the waiting room so they could call the Maryland Attorney 
General's office for guidance. They came back 30 minutes later and advised me that due to HIPPA, my 
son could require I not be allowed to testify. When 1 called the Attorney General's office the next day - 
to ask why they had made that decision, they advised me they had NOT spoken with the staff at Spring 
Grove. SO - Despite our son being in the hospital for a year- and - despite his condition - despite only 
in the last 4 weeks had they been medicating our son - they did NOT cal! us to advise us he had been 
released from the hospital. My wife called me while I was In Michigan - to advise me she had found him 
sleeping in our garage. 

Example C - Our son was 19 - and his hospital placement took him out to Washington County, MD - 
hours away. We could not coordinate anything over the phone - due to HIPAA. Eventually he was 
released - and placed on a commercial bus and sent back to Baltimore City. It took us weeks to figure 
out if he was alive or dead - and his condition. 


Example D - When our son was being diagnosed for classification as being 'disabled', the psychiatrist 
asked our son if it would be OK if his parents attended their session,. Our son refused. When he went 
into the adjoining room - he told the doctor he had served in both Gulf wars and had shrapnel in his 
body - which was causing all sorts of problems. The interviewer believed him!!! 


So many times we would have no idea as to our son's condition at the hospital - as he would refuse to 
see us - and often when we would go to visit - the staff would not acknowledge whether he was there 
or not - so we had no idea if he had been released or not. We would lie awake at night wondering 
where he was - what condition he was in - whether he had been released. 
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PUBLIC RECORDS OF OUR SON - FOUND ONLINE AT THE MARYLAND JUDICIARY CASE SEARCH WEBSITE 


CASE # 1 : 

Case Information 


Shows he is a patient at Spring Grove Hospital 

/ 


Court System: 
Case Number: 
Title: 

Case Type: 
Case Status: 
Case Dispositio 


Circuit Court for Baltimore County/- Civil System 
03C060i3732 / 

Keiiey Vs Superintendent Sprtr|^ Grove Hospital Center 
Other CIvilFiling Date:12/27/^06 
Closed/Znactive / 

: Decree or OrderDisposition j^atc:0i/05/2007 
/ - 


Plaintiff/ Petitioner Znformati^ 

{Each Plainliff/Petitfo'rer^i^Cfi^Jsyed^aw} ' ' 
Party Type; PlaintiffParty No. :1 / 

Name: Keiiey, Jon Paul 
Address: Spring Grove Hospital 

City: CatonsvilleState:MD2ip Code:2i228 


Defendant/Respondent Information 




4Baeh Bef^d9nt/Resp(Xident IS displayed below) 

Party Type; DefendantParty No,:l 

Business or Organization Name: Superintendent Spring Grove Hospital Center 


Address: Spring Grove Hospital 

City: CatonsvilleStateiMDZip Code:2i228 


Attorney(s) for the Defendant/Respondent 


Name: Maione, Esq, Daniel 

Appearance Date; 02/05/2007 

Practice Name: Office Of Attorney General 

Address; 300 West Preston Street 

Room 302 

Ctty: BaftimoreStatciMDZip Code:21201 


Document Tracking 

CSach Oocament listedi Documents are fisted in Poctiment No./SeQuer>ix No. order) 


Doc No./Seq No.; i/0 

File Date: 12/27/2006C!ose Date:01/05/2007Decision; 


CO 
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Party Type: 
Document Name: 

Doc No./Seq No,: 
File Date; 

Party Type: 
Document Name; 

Doc No./Seq No,: 
File Date: 
Document Name; 


PlaintiWarty No.:l 
Petition for Habeas Corpus 


1/1 

01/26/2007Close Date:Deciston: 

DefendantParty No.:l 
R^ponse To Petition 


2/0 

01/05/2007aose Date:0l/05/2OO7Decision: Denied 
Order for Habeas Corpus 


ex' 
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Shows our son is a patient at Spring Grove Hospitai Shows he was fighting to get out 


Case Informatic^n 


Court System : Ci^uit Court for Baftimore County •• Civil System 

Case Number: olc07013093 

Title; the Matter of Jon Paul Kelley 

Case Type; ic^ministrative Agenq^ AppealFiling Date:ll/i5/2007 

Case Status; posed/Inactive | 

Case Di5position:|Lack of ProsecutionDisposition Date:10/13/2010 ^ 


Plalntlff/P^Itloner Infoi 


tiisplayed below) 


Party Type: IptitlonerParty No.:l 
Name; Keii^ Jon Paul 
Address: Spring Grove Hospital 

City; Catonsvilie5tate;MDZip Code:21228 


Party Type; Administrative AgencyParty No. : 1 ^ 

Business or Organization Name: Spring Grove Ho^lti^ Center 
Address: Spring Grove Hospital / 

City: CatonsvilleStateiMDZip Code:2i228 / 


Doc No./Seq No.: 1/0 / 

File Date; ll/15/2007C!ose Date:1^13/2010Decision: 

Party Type: PetItionerParty No,:l ^ 

Document Name: Petition for Judicial Review/Release 




Doc No./Seq No.: 2/0 

File Date: 04/23/2009Close Date:04/23/2009Decision: 

Document Name: Notice of Cont. Dismissal Lack of Pros. 



THE GAP IN TREATING THE SEVERELY MENTALLY ILL - APRIL 26. 2013 TESTIMONY OF EDWARD KEUEY 




: ;■> • mi MLDJCATION 

THE SIGNS OF STRUGGLE APPEAR 
1 fit FAiV1!LY SEES THESE SIGNS 


Anosognosia 

NOT DENIAL 


[THE mLATVitr*! GAP r ABSENT TIMELY CARE WI TH FAMILY HELP ♦ THERE EXISTS RISK TO THE PERSON & OTHERS ] 


FAMILY SHUT OUT FROM ' SUBSTANCE USE 
DR'S -DELAYS TREATMENT TO SELF MEDICATE 


HOMELESSNESS 
UNKNOWN PLACES 


ANGER/FRUSTRATION HE INCREASED ISOLATION 
"DOES NOT UNDERSTAND" "NO ONE UNDERSTANDS" 


FAMILY HAS NO CONTROL 



FAMILY SHUT OUT j 
WHEN LOVED ONE | 
GETS (IF) HOSPITALIZED 



HELP WITH TREATMENT PLAN 



I NOT TREATED I 
I PROPERLY OR | 
RELEASED TOO SOON 



DESPERATION THE LOVED ONE CAN OR INCARCERATION OR TRAGEDY 

CRIME BECOME A VICTIM 


00 

CO 
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Mr. Murphy. Thank you, Mr. Kelley. Ms. Thomas, you are recog- 
nized for 5 minutes. Thank you. 

TESTIMONY OF JAN THOMAS 

Ms. Thomas. First of all, I would like to thank Congressman 
Braley for asking me to come to Washington to tell my story, and 
I would like to thank Chairman Murphy and Representative 
DeGette for holding this hearing today on this very important sub- 
ject. My name is Jan Thomas, and the story I have to tell is a 
nightmare that could have prevented. My life has not been the 
same since this tragedy occurred, and it changed the lives of my 
entire family and my community. 

On June 24 , 2009, what started out as a normal beautiful spring 
morning ended up being the beginning of a nightmare. Shortly be- 
fore 8:00 am, a 24-year-old former student, Mark Becker, walked 
into our high school weight room, and in front of 22 young high 
school students emptied his gun at close range into my husband, 
Ed. Ed did not survive his injuries, and he died on the way to the 
hospital. He was only 58 years old, and he had taught and coached 
for 36 years. 

In one quick moment, so many lives were impacted forever. Our 
family lost a son, husband, father, grandfather, and brother whom 
we all loved very much. The students in the weight room that day, 
along with our extended community, lost a mentor, friend, teacher, 
and a coach. They lost their sense of confidence and security, and 
the horror of that day will be with them forever. 

Innocent youngsters, including our own young grandsons, sud- 
denly realized that the world has a dark side. They were taught 
a horrible but truthful lesson that day. Bad things do happen to 
good people for no explainable reason, even when they think they 
are safe. 

Our grandsons were robbed of the deep love of their grandpa, 
and they will miss all of the experiences they could have had with 
him. My sons lost their father, whom they loved very much, and 
I lost my husband and my life partner on that day, and we miss 
him every day. 

But the real tragedy of that day is the fact that it could have 
been prevented. Only 4 days before Ed was murdered, this same 
young man rammed his car into the garage of an acquaintance and 
tried to break his way into the home with a baseball bat. When po- 
lice arrived, he fled in his car, leading the law enforcement on a 
high-speed chase. When the police finally apprehended him, he was 
taken to an area hospital for psychological evaluation. 

Less than 24 hours before my husband died, Mark decided he 
didn’t want to stay at the hospital, and so not following the advice 
of his doctor, Mark was dismissed. 

No one knew. Law enforcement was not notified, even though 
they had requested that the hospital let them know when he was 
going to be dismissed. The hospital’s justification for not notifying 
the law enforcement prior to his release was that HIPAA prevented 
this disclosure. Even his parents did not know until Mark himself 
called them later that evening. 

No one knew that Mark had been released, but Mark’s privacy 
had been protected. During the investigation into the murder, it 
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was revealed to us that Mark had feelings of animosity and resent- 
ment toward Ed. We didn’t know that. If Mark had come to my 
home that morning and asked where Ed was, I would have inno- 
cently sent Ed’s killer directly to him and Ed to his grave, and 
what a horror to think that I may have had to live with that. 

Once again, Mark’s privacy was protected. Adults with severe 
mental illnesses are not always able to make good choices for them- 
selves concerning their treatment or their actions. They may need 
help of a family member or other responsible parties to be sure 
they receive required treatment. They may need outsiders to keep 
them and others out of harm’s way, but due to HIPAA, even Mark’s 
parents were unable to get requested information or help make de- 
cisions for his treatment. 

So I would ask you. Is the privacy of one individual more sacred 
than a life? Is it more important than the welfare of our general 
public? Is it more important than allowing our law enforcement to 
know when a potentially dangerous offender is being released back 
into the very community that they risk their own lives every day 
to protect? 

Ed was an inspiration to so many in our community, and most 
importantly, he was a loving son, father, grandfather, and brother. 
I urge Congress to update this law so we can prevent further trage- 
dies like this one. 

Thank you. 

[The prepared statement of Ms. Thomas follows:] 
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Testimony 
Jan Thomas 

Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
Friday, April 26, 2013 

i would like to thank Congressman Braley for asking me to come to Washington to tell 
my story. I’d also like to thank Chairman Murphy and Representative DeGette for 
holding this hearing today on a very important subject. My name is Jan Thomas and 
the story I have to tell is a nightmare that could have been prevented. My life has not 
been the same since this tragedy occurred. It also changed the lives of my entire family 
and my community. 

On June 24, 2009, what started out as a normal beautiful spring morning ended up 
being the beginning of a nightmare. Shortly before 8.00am, a 24 year old former 
student, Mark Becker, walked into our high school weight room, and in front of 22 high 
school students emptied his gun at close range into my husband, Ed. Ed did not 
survive his injuries and died on the way to the hospital. He was only 58 years old, and 
had taught and coached for 36 years. 

In one quick moment, so many lives were impacted forever. Our family lost a son, 
husband, father, grandfather, and brother, who we loved very much. The students in 
the weight room that day, along with our extended community, lost a mentor, friend, 
teacher, and a coach. They lost their sense of confidence and security. The horror of 
that day will be with them forever. 

Innocent youngsters, including our own young grandsons, suddenly realized that the 
world has a dark side. They were taught a horrible but truthful lesson that day. Bad 
things do happen to good people for no explainable reason, even when they think they 
are safe. 

Our grandsons were robbed of the deep love of their “grandpa”. They will miss all of the 
experiences they could have had with him. My sons lost their father, whom they loved 
very much. I lost my husband and life partner on that day. We miss him every day. 

But the real tragedy of that day is the fact that it could have been prevented. Only four 
days before Ed was murdered, this same young man rammed his car into the garage of 
an acquaintance, and tried to break his way into the house with a baseball bat. When 
police arrived, he fled in his car leading law enforcement on a high speed chase. When 
the police apprehended him, he was then taken to an area hospital for psychological 
evaluation. 
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Less than 24 hours before my husband died, Mark decided he didn’t want to stay at the 
hospital. Not following the advice of his doctor, Mark was dismissed from the hospital. 

No one knew! Law enforcement was not notified, even though they had requested the 
hospital let them know when he was being dismissed. The hospital’s justification for not 
notifying law enforcement prior to his release was that HIPAA prevented this disclosure. 
Even his parents didn’t know until he called them later that evening. 

No one knew he had been released, but Mark’s privacy had been protected. During the 
investigation into the murder, it was revealed that Mark had feelings of animosity and 
resentment toward Ed. We didn’t know this information. If Mark had come to my home 
and asked where Ed was that morning, I would have innocently sent Ed’s killer directly 
to him and Ed to his grave. What a horror to think I may have had to live with that. 

Once again, Mark Becker’s privacy was protected. Adults with severe mental illnesses 
are not always able to make good choices for themselves concerning their treatment or 
their actions. They may need help of a family member or other responsible parties to be 
sure they receive required treatment. They may need outsiders to keep them and others 
out of harm's way. Due to HIPPA, even Mark’s parents were unable to get requested 
information or help make decisions for his treatment. 

I ask you. Is the privacy of one individual more sacred than a life? Is it more important 
than the welfare of the general public? Is it more important than allowing our law 
enforcement to know when a potentially violent offender is being released back into the 
very communities they risk their own lives to protect? 

Ed was an inspiration to so many in our community. Most importantly, he was a loving 
son, husband, father, grandfather, and brother. I urge Congress to update this law so 
we can prevent further tragedies like this one. 
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Mr. Murphy. Thank you, Ms. Thomas. Ms. McGraw will he rec- 
ognized for 5 minutes. 

TESTIMONY OF DEVEN MCGRAW 

Ms. McGraw. Thank you very much. I really appreciate this op- 
portunity, and I want to thank the Chairman and the sub- 
committee for focusing on these issues which are clearly very crit- 
ical. I direct the Health Privacy Project at an organization called 
the Center for Democracy and Technology, which is a non-profit 
public interest and advocacy organization that works on behalf of 
consumers. 

We like to think of privacy as playing an incredibly important 
role in making sure that people who are suffering from stigma- 
tizing conditions like mental illness will actually get into treat- 
ment. Many people express, one out of six in surveys consistently, 
that if they didn’t have some guarantees in confidentiality that 
they would not seek treatment, and that is the reason why we have 
privacy laws. They are not aimed at trying to create obstacles for 
people necessarily but to create the kind of treatment environment 
that people with stigmatizing conditions with want to be in. 

Having said that, they are not absolute. They have lots of excep- 
tions, and the previous panel talked about them, some of the mem- 
bers of this panel have talked about them as well, that allow for 
the notification of persons in the event of a serious and imminent 
threat and also notification of family members except in cases 
where there has been an objection by a patient who has the right 
to object. So in this case it would be either an adult or an emanci- 
pated minor or in some States that allow minors to consent for 
treatment on their own and to be able to control their privacy 
rights. In that case the minor would hold the right. If that objec- 
tion has not occurred or you are not dealing with someone who is 
incapacitated, HIPAA does provide for the ability for providers to 
share information with family members, with close friends, or with 
people that the patient designates. 

Having said that, I think it is abundantly clear from the testi- 
mony that we have heard today that HIPAA is badly mangled in 
terms of how people interpret it, and using it frequently as a shield 
not to disclose information or because they fear liability, which, 
frankly, is not anywhere in HIPAA, and it is — what is incredibly 
frustrating to me when I hear these stories, and I am sure it is 
frustrating for all of you, too, is that HIPAA doesn’t say you can’t 
disclose. So for people to blame this on HIPAA is just incredibly 
frustrating because, in fact, HIPAA does allow those disclosures in 
those cases, and where the disconnect is happening is just incred- 
ibly frustrating to me. Again, I am a privacy advocate, but I believe 
in the reasons for these exceptions. We try to take a very balanced 
approach to these issues and understand the reason why those ex- 
ceptions exist, and yet for whatever reason the myth that you can’t 
disclose to family members, and, again, this is — the disclosure to 
family members are not bound by the potential for a serious and 
imminent threat. 

It is the case, though, that if an individual objects, again, if they 
have the competency and the power to object, then that would be 
the case where you couldn’t disclose. But I would say more often 
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than not there is, again, experiences of the folks at this table not- 
withstanding, people actually want their family involved in their 
care. I have had people say to me, my mother, my elderly mother, 
who I am caring for, I would like to be able to have her doctor talk 
to me about her treatment and yet that office is telling me that 
HIPAA will not allow it to happen. And that is so untrue and so 
I am incredibly sympathetic to the frustration of people who are 
told that HIPAA requires something that it doesn’t, and I am try- 
ing to figure out what we can do better in terms of educating folks 
about what HIPAA does and what it doesn’t do because it sounds 
to me like too many people are hiding behind it in circumstances 
where there are clear exceptions that would allow for that informa- 
tion to be shared. 

Some of the testimony of Director Rodriguez in the first panel, 
frankly there was a lot more — I had a lot greater understanding of 
the exception for family members than I did before the hearing, 
and so that suggests to me that this guidance, which I think is 
good, it is not the letter that everyone has been talking about be- 
cause the letter deals with serious and imminent threat. This is 
guidance about what can be shared with family members because 
often patients, in fact, want their information to be shared with 
one or more of their family members or a close friend who is help- 
ing to care for them, and yet it doesn’t happen. 

And it could be made more clear, frankly, and we could find bet- 
ter ways of disseminating this guidance. I mean, I know where it 
is on the Web site, but there is probably lots of folks who can’t find 
it, who aren’t aware that it exists, and particularly when faced 
with a person and a healthcare facility telling them, which is prob- 
ably something that they unfortunately believe, that HIPAA won’t 
allow that information to be shared, when, in fact, it does. 

I am happy to answer any questions, and I appreciate the oppor- 
tunity. 

[The prepared statement of Ms. McGraw follows:] 
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Chairman Murphy and Members of the Subcommittee: 

On behalf of the Center for Democracy & Technology (CDT), I thank you 
for the opportunity to testify today. 

The Center for Democracy and Technology (“CDT") is a non-profit Internet 
and technology advocacy organization that promotes public policies that 
preserve privacy and enhance civil liberties in the digital age. As 
information technology is increasingly used to support the exchange of 
medical records and other health information, CDT, through its Health 
Privacy Project, champions comprehensive privacy and security policies to 
protect health data. CDT promotes its positions through public policy 
advocacy, public education, and litigation, as well as through the 
development of industry best practices and technology standards. 
Recognizing that a networked health care system can lead to improved 
health care quality, reduced costs, and empowered consumers, CDT is 
using its experience to shape balanced, workable privacy solutions for a 
health care system characterized by electronic health information 
exchange. 

The question posed at this hearing is whether the privacy regulations 
under the Health Insurance Portability and Accountability Act of 1996 
(HIPAA) help or hinder patient care and public safety. The short answer is 
that HIPAA's provisions by design enable the sharing of health 
information, including mental health information, for both patient care and 
public health and safety. However, frequently these provisions are not 
fully understood and are too often misinterpreted, which may have a 
detrimental impact on both policy goals. 
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Privacy Is Mamentai to Good Health Care 

Americans consistently express concerns about the privacy of their health information. 
Researchers have focused on this issue more intensively in the last several years in 
response to initiatives aimed at increasing adoption of electronic health records. In a 
2006 survey, when Americans were asked about the benefits of and concerns about 
electronic health records; 

• 80% said they are very concerned about identity theft or fraud; 

• 77% reported being very concerned about their medical information being 
used for marketing purposes; 

• 56% were concerned about employers having access to their health 
information; and 

• 55% were concerned about insurers gaining access to this information.’ 

Privacy rules are frequently criticized as providing obstacles to effective care, but in fact 
the opposite is true: patients who mistrust whether their information will be handled 
confidentially will not fully participate in their own health care.” Without appropriate 
protections for privacy and security in the healthcare system, people will engage in 
"privacy-protective" behaviors to avoid having their personal health information used 
inappropriately.’ Such privacy-protective behaviors include failing to seek care for 
sensitive medical conditions, asking health care providers to leave sensitive information 
out of the medical record, and traveling outside of the area to seek care.’ According to 
a 2007 poll, one in six adults (17%) - representing 38 million persons - say they 
withhold information from their health providers due to worries about how the medical 
data might be disclosed.’ A September 201 1 study by the New London Consulting 
commissioned by FairWarning®, a vendor of breach detection software, found that: 


' study by Lake Research Partners and American Viewpoint, conducted by the Markle Foundation 
(November 2006). In a more recent survey conducted by the Markle Foundation, more than 80% of both 
the public and doctors surveyed said that requiring protections and safeguards for patient privacy was 
important. httD://www.markle.orQ/Dublications/1443-public-and-doctors-aqree-imDortance-soecific-Drivacv- 
protections-heaith-it (January 201 1) 

^ See Janiori Goldman. “Protecting Privacy to Improve Health Care." Health Affairs (Nov-Dec, 1 998) 
(Protecting Privacy): Promoting Health/Protecting Privacy: A Primer. California Healthcare Foundation 
and Consumers Union (January 1999), httD://www.chcf.orq/toDics/view cfm?itemiD- 12502 (Promoting 
Health/Protecting Privacy). 

^id. 

"id. 

® Harris Interactive Poll #27, March 2007. Persons who report that they are in fair or poor health and racial 
and ethnic minorities report even higher levels of concern about the privacy of their personal medical 
records and are more likely than average to practice privacy-protective behaviors. National Consumer 
Health Privacy Survey 2005, California Healthcare Foundation (November 2005). 
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• 27.1% of respondents stated they would withhold information from their care 
provider based on privacy concerns. 

• 27.6% said they would postpone seeking care for a sensitive medical condition 
due to privacy concerns. 

• Greater than 1 out of 2 persons said they would seek care outside of their 
community due to privacy concerns, and 35% said they would drive more than 50 
miles to seek care.‘ 

The consequences of this climate of fear are significant - for the individual, for the 
medical community, and for public health and safety: 

• The quality of care these patients receive may suffer; 

• Their health care providers' ability to diagnose and treat them accurately may be 
impaired; 

• The cost of care escalates as conditions are treated at a more advanced stage 
and in some cases may spread to or impact others; and 

• Research, public health, and quality initiatives may be undermined, as the data in 
patient medical records is incomplete or inaccurate.^ 

Assurances of confidentiality are particularly important for mental health treatment. It is 
estimated that one in four adults in America suffers from a diagnosable mental disorder 
in a given year; ® nearly 2/3 do not seek treatment due in part to lack of knowledge, fear 
of disclosure, potential rejection of friends, and discrimination,® Laws protecting mental 
health information are designed to help address these fears and remove potential 
barriers to treatment. 

Protections and Permissions lor Using and/or Disclosing Health iniormation 

The HIPAA Privacy Rule sets parameters for the use and disclosure of identifiable 
health information by health care providers, health plans, and health care 
clearinghouses, and the contractors (or business associates) who obtain identifiable 
health information in order to perform services on their behalf The Privacy Rule takes a 
decidedly balanced approach to privacy, giving individuals the right to control certain 


® http://www.faiiwarningaudit.com/documents/2011-WHITEPAPER-US-PATIENT-SURVEY.pclf 
^ Protecting Privacy, supra note 2. 

® NIMH - The Numbers Count: Mental Disorders in America, 

http://www.nimh.nih.gov/health/publications/the-numbers-count-mental-disorders-in-america/index.shtml. 

° "Facts about Stigma and Mental Illness In Diverse Communities," National Alliance on Mental Illness. 
http://www.nami, orQ/Content/Microsites270/NAMI Howard Countv/Home258/Multlcultural Actionj/Stiam 
aandMentallllnessinDiverseCommunities.pdf . 
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uses and disclosures while also expressly allowing uses and disclosures to meet routine 
health care needs and public policy goals. In general, the Privacy Rule requires the 
express authorization of the patient before identifiable health information can be 
accessed, used or shared, but the Rule includes a number of exceptions designed to 
facilitate access and sharing of health information for patient care, to facilitate payment 
for care, for public health, and for other uses deemed critical to a functioning health care 
system. Of particular importance to this hearing, the Privacy Rule allows a patient’s 
health information to be shared to facilitate treatment, without the need to obtain either 
an oral consent or formal written authorization from the patient. 

The Privacy Rule treats all identifiable health information the same, with one notable 
exception: psychotherapy notes are provided with additional protections. Not all mental 
health information about a patient qualifies as “psychotherapy notes;” that term is limited 
to the notes of a mental health professional taken during a counseling or therapy 
session. Entities covered by the Privacy Rule must obtain a specific, formal 
authorization from the patient in order to disclose psychotherapy notes in most 
circumstances (such notes can be used internally to treat the patient).” In addition, the 
right of patients to access and obtain a copy of their health information does not apply to 
psychotherapy notes.'^ 

The Privacy Rule also includes a number of provisions that expressly allow certain uses 
and disclosures of health information for important public policy reasons. These 
exceptions allow entities covered by HIPAA to use or disclose information: when 
required to by law; for public health activities; for the reporting of abuse; for health care 
oversight; for judicial and administrative proceedings; for law enforcement; and to 
coroners, to note just a few examples.’^ 


Psychotherapy notes are “notes recorded (in any medium) by a health care provider who is a mental 
health professional documenting or analyzing the contents of conversation during a private counseling 
session or a group, joint or family counseling session and that are separated from the rest of the 
individual's medical record. The term 'psychotherapy notes’ excludes data relating to medication 
prescription and monitoring, counseling session starts and stop times, the modalities and frequencies of 
treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, 
functional status, the treatment plan, symptoms, prognosis, and progress to date," 45 C.F.R. 164.501, 

” 45 C.F.R, 164.508(a)(2). Such notes may be used by the originator in order to treat the patient: they 
also can be used for training purposes and to defend against a legal action or other proceeding. Id. Of 
note, the U.S. Supreme Court, in a case recognizing psychotherapist-patient privilege in federal rules of 
evidence, acknowledged the critical role that confidentiality of psychotherapy notes plays in mental health 
treatment: “Effective psychotherapy ... depends upon an atmosphere of confidence and trust in which 
the patient is willing to make a frank and complete disclosure of facts, emotions, memories, and fears. 
Because of the sensitive nature of the problems for which individuals consult psychotherapists, disclosure 
of confidential communications made during counseling sessions may cause embarrassment or disgrace. 
For this reason the mere possibility of disclosure may impede development of the confidential relationship 
necessary for successful treatment." Jaffree v. Redmond, 518 U.S. 1 (1996). 

’^45 C.F.R. 164.524(a)(1)(i). 

See provisions of 45 C.F.R. 164.512. 
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Of specific interest for this hearing, entities covered by HIPAA are expressly permitted 
to use or disclose information to avert a serious threat to health or safety. Specifically, 
an entity may, 

“consistent with applicable law and standards of ethical conduct, use or 
disclose protected health information if [it], in good faith, believes the use 
or disclosure is necessary to prevent or lessen a serious and imminent 
threat to the health or safety of a person or the public; and [the use or 
disclosure] is to a person or persons reasonably able to prevent or lessen 
the threat, including the target of the threat."^'* 

Entities are expressly presumed to be acting in good faith if they are acting based on 
actual knowledge "or in reliance on a credible representation by a person with apparent 
knowledge or authority.”^^ On January 15, 2013, the HHS Office for Civil Rights issued 
a two-page, to-the-point letter to health care providers alerting them to this exception, in 
the hope of dispelling widespread myths that HIPAA does not permit such disclosures.’® 

The HIPAA Privacy Rule provides a floor of privacy protections, at least for health data 
collected, used and shared by entities covered by its provisions. However, it is not the 
only law protecting mental health data. States are permitted to enact more stringent 
protections for health privacy, and nearly all states have specific statutes related to 
mental health privacy.” In addition, Congress has expressly acted to protect the 
privacy of health information in other sensitive records, and these laws were not 
preempted by HIPAA. In recognition of the potential stigma and the legal implications of 
seeking alcohol and drug treatment, Congress enacted the Federal Confidentiality of 
Alcohol and Drug Abuse Patient Records law, which provides heightened protections for 
alcohol and drug use treatment records maintained by any programs receiving some 
form of federal assistance.’® The Family and Educational Rights and Privacy Act of 
1974 (FERPA) protects the privacy of student education records, inciuding information 
related to treatment of a student for substance use or mental health conditions,’® Most 
state laws restricting disclosures of health information typicaliy include emergency 
exceptions;®” however, we are not aware of any comprehensive compilations of state 


45 C.F.R. 512(j). This provision also includes the circumstances under which law enforcement can be 
alerted when an individual has admitted committing a violent crime or is believed to have escaped from a 
correctional institution or from lawful custody. 45 C.F.R. 512(j)(1)(ii). 

'*45 C.F.R. 512(|K4). 

http://vwvw.hhs.aov/ocf/Drivacv/hipaa/understandino/eonsumers/riahttoaccessmemo.pdf . 

Beckerman, J et al., “Health Information Privacy, Patient Safety, and Health Care Quality; Issues and 
challenges in the Context of T reatment for Mental Health and Substance Abuse,” SNA’s Health Care 
Policy Report, vol, 16, No. 2 (January 14, 2008). This article includes a comprehensive discussion of 
HIPAA's provisions regarding “preemption.' 

Id. See 42 C.F.R. Part 2 for the regulations that set forth the stringent rules regarding use and 
disclosure of patient information. 

Id. See 34 C.F.R. Part 9 for regulations. 
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mental health laws (such state law surveys are typically expensive to produce and 
rapidly rendered out of date) that would enable us to discuss state law provisions in 
more detail. FERPA includes an exemption allowing disclosure of student information in 
emergencies, when the information is necessary to protect the health or safety of the 
student or others.^’’ Regulations governing federally assisted alcohol and drug treatment 
programs have more limited exceptions for emergencies.^ 

Ahiilty to Share Health infemiation with family, friends under HIPM 

When HIPAA's Privacy Rule first went into effect a decade ago, people widely believed 
that it did not permit disclosure of a patient's health information to family members 
under any circumstances. That has never been the case, but this myth stubbornly 
persists. The Privacy Rule expressly permits disclosure .to someone who is involved in 
a patient's care or in payment for that care - either a family member, other relative, or a 
close personal friend of the patient, or any other person identified by the patient - 
unless the patient objects to the sharing of that information.^® The information that may 
be shared is only information that the person involved in the patient's care (or in paying 
for that care) needs to know (so past diagnoses not related to the patient’s current 
health condition, for example, could not be shared under these provisions). If the 
patient is not conscious (or not present), a provider can still share relevant health 
information with family or friends if he or she believes it is in the patient's best interest to 
do so. 

The HHS Office for Civil Rights has issued guidance on these provisions, which 
explains them more clearly and in non-legal language;®" however, it is unclear how 
many providers, individuals, and family members are aware of this guidance. This 
guidance also may not be in sufficient detail to address common questions and clear 
misperceptions. 

HIPAA requires that a patient’s “personal representative" be treated as the patient for 
purposes of the Privacy Rule.®® Persons who, under applicable law, have authority to 
act on behalf of a patient tor health care decision purposes must be treated as personal 
representatives. For minors, this typically is a parent, guardian or other person acting in 
loco parentis: however, where state law permits the minor to seek care without the 


®' Id. See 20 U.S.C. 1232g. 

“ 42 C.F.R. Part 2 permits disclosure of information without consent to enable notification of medical 
personnel in the event of a medical emergency (in a situation that poses an immediate threat to the health 
of any individual); to enable notification of law enforcement if an immediate threat to health or safety of an 
individual exists due to a crime on program premises or against program personnel; and to enable 
reporting under state law of suspected child abuse or neglect. Information can be disclosed to law 
enforcement about an immediate threat to the health or safety of an individual not involving a crime on 
program premises or against program personnel if patient-identifying information is not disclosed. 
httD;//www.samhsa.aov/about'laws/SAMHSA 42CFRPART2FAQIi Revised, pdf . 

45 C.F.R. 510(b). 

®'* httD://www.hhs.aov/ocr/privacv/hipaa/understandina;coveredentitiesfprovider ffg.pdf . 

®45 C.F.R. 164.502(g), 
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consent of a parent, which in some states may bathe case for mental health treatment, 
the minor has greater authority to designate when a parent or guardian can receive 
health information. State laws typically establish the circumstances under which an 
individual may act as the personal representative of another with respect to health care 
decisions. 

Paths forward 

As noted above, the HIPAA Privacy Rule permits the sharing of relevant mental health 
and other personal health information in order to avert a serious threat to health or 
safety, and to family members and friends who are involved in a patient's care, with 
some exceptions. It is important to keep in mind, however, that the Privacy Rule 
permits but does not require information to be shared in these circumstances. (The 
Privacy Rule only expressly requires information to be shared in two instances: (1) with 
the patient or his or her personal representative, or (2) with the government in the event 
of a HIPAA compliance audit.) 

Fear of liability for violating HIPAA's provisions, coupled with misunderstanding of its 
provisions, can be a recipe for not sharing, even in circumstances where such sharing is 
expressly permitted and arguably important for patient care and/or public safety. 
Additional guidance from the Office for Civil Rights, with even greater clarity on 
permitted uses and disclosures, could be enormously helpful at dispelling myths and 
easing the concerns of mental health professionals. Working with relevant professional 
societies to ensure that this guidance is widely disseminated (and written in terminology 
likely to be understood) would also be helpful. The Administration should also take 
steps to ensure such guidance can be issued in a timely way. 

States should also examine their statutes covering mental health information to ensure 
that they meet the needs of patients both for confidentiality and to have the wanted 
support of family and close friends in their care, and urgent public safety needs. 

Conclusion 

Thank you for the opportunity to present this testimony, and I would be pleased to 
answer any questions you may have. 
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Mr. Murphy. Thank you very much. We thank all the panelists. 
I want to also say here that our hearts go out to the families, Mr. 
Wolfe, Mr. Kelley, and Ms. Thomas. It is a sad tragedy and Mr. 
Kelley, that you are still dealing with here. 

We are going to recognize each person for 5 minutes. 

I just want to make it clear, Ms. Levine, you stated you had 
some opinions in your testimony. You are not a licensed provider, 
am I correct? 

Ms. Levine. No, no. We are 

Mr. Murphy. And you are not a practicing therapist in this field? 

Ms. Levine. Not at all. 

Mr. Murphy. OK. It is just very important for the record because 
on page ten of your written testimony you said that doctors don’t 
want to share information, and it is, “a convenient excuse not to 
talk to families or listen to what they know about a patient.” You 
went on to say it is, “easier to avoid difficult conversations about 
prognosis and treatment options.” 

Dr. Martini, is that true that doctors don’t want to know this, 
they don’t want to know this information, they don’t want to talk 
to families because it is difficult? 

Dr. Martini. No. I think that the vast majority of physicians 
that I work with are very interested in sharing that information 
and very much want, I think, to involve families in care. I mean, 
I think we know that particularly for psychiatric patients that their 
prognosis is approved, that, one of the ways I look at it is I see a 
patient perhaps at the very most an hour a week, and the families 
are dealing with these individuals on an ongoing basis, and I think 
any recommendation that I make as a clinician is much more likely 
to be successful if I am able to get the support of the family. 

Mr. Murphy. Mr. Wolfe, Ms. Thomas, and Mr. Kelley, just real 
briefly, just in a word or two because I don’t have a lot of time, 
also from your standpoint because you have also talked to pro- 
viders about these cases, do you think in these cases the providers 
did not want to talk to you, or they did, but they felt they could 
not because of their interpretation of the law? 

Mr. Wolfe? 

Mr. Wolfe. Yes. My family physician told me later that he did 
want to disclose it, but he felt that he was under the obligation of 
the HIPAA rules not to disclose it. 

Mr. Murphy. Mr. Kelley? 

Mr. Kelley. In 14 years I have never encountered a situation 
where a treatment provider did not want to disclose it. In fact, they 
went out on a limb and would secretly tell us. No, I have never had 
that. 

Mr. Murphy. Ms. Thomas? 

Ms. Thomas. I can only speak for what law enforcement told me 
and also what Mark’s parents have told me about, and they all had 
difficulty getting information. 

Mr. Murphy. Thank you. Mr. Wolfe, Mr. Kelley, you heard from 
Mr. Rodriguez from the Office for Civil Rights that the law, it 
sounds like he is saying that the law is adequate, and the problem 
is that providers aren’t really aware of the law and are 
unjustifiably worried about lawsuits, perhaps even hospital admin- 
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istrators who pressure staff not to disclose information or they will 
be fired. 

Do you think that is true that it is adequate, both the way the 
law is worded and in terms of the way information gets out to pro- 
viders? 

Mr. Wolfe? 

Mr. Wolfe. I don’t think it is adequate as far as getting out to 
the providers because both in my son’s case with the rehab situa- 
tion, as well as my family care physician, both of them after Justin 
deceased, I confronted them, and they both told me that they defi- 
nitely would have said something with regard to informing me. 
However, again, with Justin signing the HIPAA disclosure, they 
were not permitted to. So I do feel that they did have an obligation. 
They knew that it was a life-threatening situation with the use of 
heroin, but they were obliged to follow the HIPAA regulations. 

Mr. Murphy. Thank you. Mr. Kelley? 

Mr. Kelley. In all due respect I fear there is a significant de- 
tachment from reality here. Not with you, sir, but with Mr. 
Rodriguez. It is underlined, unless the patient objects, and someone 
that is severely mentally ill universally wants to object. They don’t 
believe they are ill. 

So that gets thrown out the window, and the fact is that we need 
to have exceptions for the severely mentally ill. It is just plain and 
simple. 

Mr. Murphy. Ms. Thomas? 

Ms. Thomas. I can speak on behalf of the fact that I am a volun- 
teer EMT for our community, and the threat of lawsuit, it prevents 
us even from feeling like we are able to tell direct family members 
conditions of patients that we transport. So either it is misunder- 
standing but that is what is emphasized to us in our training. 

Mr. Murphy. Thank you. Ms. McGraw, in your written state- 
ment you said that 17 percent, or about 38 million, say they would 
withhold information from healthcare providers due to worries 
about how medical information may be disclosed. You were citing 
a study. 

Ms. McGraw. Yes. 

Mr. Murphy. My understanding is that study was on general 
health issues, not mental health or severe mental illness. Am I cor- 
rect? 

Ms. McGraw. No. That is right. In the time that I had to pre- 
pare for this testimony I looked for some more specific statistics on 
persons being held back from seeking treatment for mental health, 
and I didn’t have 

Mr. Murphy. Sure. 

Ms. McGraw [continuing]. Enough time to find something di- 
rectly on point. I did find something on the National Alliance on 
Mental Illness Web site that talked about how two-thirds of the 
people with mental illness do not seek treatment for a number of 
reasons; the lack of knowledge, fear of disclosure 

Mr. Murphy. Yes. I appreciate that, and I hope if you find some 
other studies, could you 

Ms. McGraw. Yes. I would be happy to keep looking. 

Mr. Murphy. I might also say that 

Ms. McGraw. I just ran out of time. 
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Mr. Murphy [continuing]. We have folks here also saying that 
doctors didn’t disclose information, and people are over-interpreting 
the law, not disclosing it here, and you are saying that perhaps pa- 
tients are also over-interpreting that it would he disclosed. 

Let me ask you this. Could you — something very important. You 
said it is badly mangled. I think those were your words. What 
could be done to clarify the law? Do we need legislative language, 
do we need to cite case law, do we need some clarification from the 
Office for Civil Rights, more public education? What do we need 
here? 

Ms. McGraw. The badly mangled part is — was the reference to 
the fact that we had all this testimony about what is really in 
HIPAA and yet people are being told, in fact, that HIPAA is some- 
thing that it is not and with significant consequences. 

You know, more guidance and better ways of disseminating it so 
it is not, you don’t have to look really hard for it on a Web site ab- 
solutely is the first step that we should be pursuing here, and 
ideally that could be done in conjunction with the professional soci- 
eties who have more effective mechanisms for doing outreach to 
their members. You know, having read this guidance, I am like, 
well, it is clear, but it could be made more clear, more examples. 
In this circumstance you can do X. In this circumstance, you can 
do Y. 

Mr. Murphy. Thank you. We will look forward to getting your 
specific recommendations. 

Mr. Braley, 5 minutes. 

Mr. Braley. Thank you, and I should also note, Mr. Chairman, 
that Ed Thomas’s sister, Connie Flaharty, is also in the audience 
today. This has impacted her as well, and Jan, I think some of the 
things that your testimony brought out is there is this 
misperception that the issues we have been talking about today are 
unique to large urban areas with a higher concentration of people 
who are seeking treatments for severe mental illness. Parkersburg 
is a town of 2,000 people. Five years ago this May it was nearly 
destroyed by an F5 tornado, and your husband, Ed, was one of 
those people in the town who rallied people to come back, put the 
community back together, and one of the other things that I think 
is so important about your story is that Mark Becker is someone 
you and Ed knew very well. 

Ms. Thomas. Exactly. Yes. He was a member of our community. 
We have known him his entire life and his parents, and I know 
their frustration in getting him treatment, but there again, I agree 
with what they are saying. When it comes to severely mentally-ill 
people, you can’t classify them with someone that has cancer or 
hepatitis or those kinds of things because their thinking is just not 
rational, and I think there maybe needs to be some exceptions to 
those rules there. 

Mr. Braley. Well, and one of the other things that we know is 
that from the stories that have come out, you and Ed went to the 
same church as Mark Becker’s parents. So it wasn’t like this was 
a stranger in your family, and I know that the Becker family has 
expressed some of the exact same frustrations as parents that we 
have heard from the other panelists in trying to get Mark the help 
he needed so that he could put his life back together, and I think 
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that is one of the most disturbing things about this topic is these 
are stories we hear over and over and over again, and it points to 
a breakdown in our ability to get people who need it the services 
that they need in communities all over this country. 

But one of the things that I am really interested in is how this 
particular tragedy in your life has changed how people in your com- 
munity think about the problems we have been talking about. 

Ms. Thomas. Well, it is hard to speak for other people, but I do 
think there needs to be more awareness of mental health. I think 
this needs to be expanded on quite a bit. I don’t think there is 
enough resources out there for people. I think the fact that no one 
knew that Mark was released and a threat was very frustrating to 
people. I mean, there were a lot of victims involved. It wasn’t just 
our family. Those young kids were 14 and 15 years old that wit- 
nessed their coach getting shot down at close range in cold blood, 
and it all could have been prevented, and I think that is a big frus- 
tration for a lot of people. They are just — he was not able to get 
out of harm’s way, and he was loose on the streets just because he 
wanted to be. 

Mr. Braley. Well, I think one of the other things this points to 
is I lived with somebody with a severe mental illness 40 years ago, 
and I remember the stigma attached to mental illness then, and I 
think we would like to think that we have come a long ways as a 
society in dealing with mental illness 

Ms. Thomas. Yes. 

Mr. Braley [continuing]. As something that is just as real and 
impacts people’s lives as much as other diseases, but I think the 
reality is that there is still a lot of stigma attached to it. We like 
to avoid having these conversations unless it is impacting us per- 
sonally. So I want to thank all the panelists for having the courage 
to come share your stories. I know that it has been an incredible 
challenge for all of you. 

And one of the things that I talked about earlier is this challenge 
that family members have with adult children of being able to have 
a role in making decisions about their care when there are some- 
times obstacles, and Dr. Martini, you talked about this a little bit, 
and one of the questions I had raised earlier was whether this risk 
to self or others standard is still a viable way of getting patients 
the help they need for a truly effective treatment. You gave exam- 
ples of both sides of the story; one where a family’s intervention 
was counterproductive, one where the need for family intervention 
was not provided that could have been in the best interest of the 
patient. 

So how do we resolve this? 

Dr. Martini. Well, I think. Congressman, what I would like to 
do is think about what you last referred to, what is in the best in- 
terest of the patient, what do we think is going to help the patient 
most, help them in their recovery. I understand that there are 
issues around the release of information and confidentiality, and I 
understand that patients are sensitive about that, but what we are 
talking about is not a release of information generally out to the 
community. What we are talking about is thinking about particular 
cases, looking at those cases on a more individual basis, and decid- 
ing if this patient is going to do well, what is going to be necessary. 
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what kind of information needs to be shared, should that informa- 
tion be shared with family members, are they an asset in this par- 
ticular case, and can they help out this individual? Would it be a 
good idea to share the information with the primary care physician 
in their community who quite often coordinates care in a variety 
of ways. That is also an asset that quite often is not part of the 
process in some ways because the patients are reluctant to have 
any local connection know much about what is going on with them. 

Mr. Braley. Thank you. 

Dr. Martini. So it is what is in the interest of the patient. 

Mr. Murphy. Thank you. Mr. Braley, that article you referenced 
before from Sports Illustrated, would you submit that for the bind- 
er so it is in the record as well? 

Mr. Braley. I would be happy to. 

Mr. Murphy. That has got to be tragic for all the reasons some- 
one would be on the cover of Sports Illustrated, that has got to be 
the saddest. It is. Thank you. 

Now recognize for 5 minutes the gentleman from Virginia, Mr. 
Griffith. 

Mr. Griffith. Mr. Chairman, if I could pass at this time, I would 
appreciate that. 

Mr. Murphy. We will do that. We will go to Mr. Johnson for 5 
minutes. 

Mr. Johnson. Thank you, Mr. Chairman. First of all, panel 
members, I would like to reiterate thank you so much for being 
with us today and for your testimony. I know these are very tough 
testimonies to give, and our hearts go out to you. 

Ms. Levine, you suggest that healthcare workers sometimes use 
HIPAA as an excuse not to share information and not simply be- 
cause they are afraid of fines or sensors. Why else would someone 
withhold information from inquiring family members? 

Ms. Levine. Well, because the role of a family member in the 
care of someone who is, as I said, my, most of my experience is 
with older adults, although I personally was the family caregiver 
for my late husband for 17 years. He had a traumatic brain injury 
and was quadriplegic. So I have my own experiences with this sys- 
tem. 

But family members ask hard questions. They want to know a 
lot of information about why did this happen, what can I expect, 
why are you giving this medication when it is on the list that says 
this is contraindicated. I can’t tell you, and this is not to disparage 
the nursing profession because they are fabulous, but I have had 
so many nurses say to me, are you trying to tell me how to do my 
job? OK. Yes. I think I am because my husband should not have 
this medication and that medication together. 

So there is a kind of — I can’t tell you how many physicians, 
nurses have said to me, family members, they are pests, they are 
nuisances, and they are. I mean, I am not denying that because 
they ask the hard questions. The patient in the bed is in pain or 
is sedated, not going to be a trouble. 

Mr. Johnson. OK. 

Ms. Levine. So it is, I think it is a truth universally acknowl- 
edged that family members are important on the day of discharge. 
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take — get them home but not necessarily in the course of a hos- 
pitalization. 

But I really think that the HIPAA scare, and I am now con- 
cerned that there is now going to be a high tech scare because I 
am already getting emails from vendors saying, we are going to 
protect you from these horrible audits that are going to happen, 
and if you only you hire us, you know, you will be safe. 

Mr. Johnson. Oh, yes. Every time there is a new government 
regulation an industry crops up 

Ms. Levine. Yes. 

Mr. Johnson [continuing]. Around, providing services. 

Ms. Levine. And, so, I mean, it is not one thing. It that things 
support each other 

Mr. Johnson. OK. 

Ms. Levine [continuing]. Is my feeling. 

Mr. Johnson. Let me quickly go to several other questions. 

One of your recommendations has been for OCR to reinforce to 
healthcare providers the provision in HIPAA that permits disclo- 
sure of relevant information, protected health information to family 
caregivers or others who are going to be responsible for providing, 
managing, or paying for a patient’s care. How do you suggest OCR 
go about doing this? 

Ms. Levine. Well, I think throughout — and I agree that the Web 
site is one way but not the best way. I think that there can be in- 
volving the medical professions, involving the people, the risk man- 
agers who are doing a lot of the training, involving the leaders and 
saying, this is not good patient care. We are concerned about hos- 
pital readmissions. One of the reasons people come back to the hos- 
pital in 30 days and cost Medicare tons of money is that the family 
members who are responsible for that care don’t know what to do. 

Mr. Johnson. OK. 

Ms. Levine. So they bring them back. 

Mr. Johnson. Do you have recommendations for CMS as well? 

Ms. Levine. Yes. CMS should definitely encourage as part of the 
conditions of participation in Medicare and Medicaid to make sure 
that the training that they are responsible, accountable for training 
the hospitals and nursing homes to train their staff in a balanced 
way, and one more thing which I didn’t get a chance to say. 

Mr. Johnson. Quickly. I am running out of time but go ahead. 

Ms. Levine. Just quickly. When we encounter through our con- 
tacts with providers, patients who object to having a family mem- 
ber involved, it has nothing to do with privacy. It has to do with 
I don’t want my — I don’t want to worry my daughter, I don’t want 
her to 

Mr. Johnson. OK. 

Ms. Levine [continuing]. Have any responsibilities. It is not the 
privacy. 

Mr. Johnson. Got you. OK. Mr. Kelley, you have observed that 
a clear culture of fear pervaded one of the facilities your son was 
admitted to. How does this culture of fear impact decision making 
by those healthcare workers and facilities tasked with taking care 
of your son? 

Mr. Kelley. And it is more than one hospital, sir, but essentially 
we are not in a position to prevent horrific things from happening. 
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and we have had some candid discussions with staff and doctors in 
multiple hospitals, where they all acknowledge that, they use the 
word, our hands are tied, due to the HIPAA privacy rules. And so 
we try to go further and emphasize the inability of the patient to 
take care of themselves and make good decisions, and it doesn’t 
phase them. 

So what happens is the patient gets mistreated actually, and so 
our son has come home and been on the wrong medication and has 
been in a horrible condition. So it is pervasive. It is not just iso- 
lated in one situation. 

Mr. Johnson. Thank you. Mr. Chairman, I yield back. 

Mr. Murphy. Thank you. The gentleman’s time has expired. 

Ms. DeGette for 5 minutes. 

Ms. DeGette. Thank you very much, Mr. Chairman, and I would 
like the panel to know that I have read all of your testimony even 
though I wasn’t here to hear you say it, and for those of you have 
lost loved ones, my deepest condolences. I know, as I said in my 
opening statement, I know how difficult it is to have a child with 
a severe illness. My child has a physical illness, not a mental ill- 
ness, and she is now a freshman at college. So I know what you 
have been dealing with in terms of — and Dr. Martini, I know what 
you were talking about in your testimony, too, of the parents pay- 
ing the college, you know, the college tuition, parents obviously love 
the child and are deeply concerned, and yet the child is over 18, 
and they are wanting to become independent, and they do have pri- 
vacy issues. It is a really hard balance especially when you are 
dealing with some of these mental illnesses which as we learned 
in our previous briefings in this panel from professionals, bipolar 
disease manifests, which is at the root of some of the violence, most 
notably suicides, that evidences itself in young men between the 
ages of 18 and 25 and in young women at a slightly older age. But 
this is right at the age where they are becoming independent from 
their families, and most of the time they are over 18. 

So it is a hard balance because on the one hand it is like Ms. 
McGraw was talking about, you want these young people to not 
feel the stigma so that they will get medical treatment and on the 
other hand as parents we want to know if they are at risk to them- 
selves or to others, and so it is a balance. 

Dr. Martini, something you said just a moment ago really struck 
me, which is, you know, in trying to grapple with this issue you 
said that we need to look at the individual. The doctor, we need 
to rely on the doctors to look at the individual cases and to see if 
this is a situation where having parental involvement or involve- 
ment of another responsible adult would be appropriate to let them 
know. And I guess I agree with that, but I guess I also in listening 
to the testimony of the last panel would — that is exactly what they 
were saying. What they were saying is in their interpretation of 
HIPAA that is exactly what medical providers are allowed to do. 

And so I think what we need to do is we need to — providers need 
to understand what their abilities are under HIPAA. Wouldn’t you 
agree with that? 

Dr. Martini. I mean, I think that that is a very important part. 
I think educating providers about HIPAA also in a way that makes 
it seem like this is more of a collaboration that 



104 


Ms. DeGette. Right. 

Dr. Martini [continuing]. There is information to be gained. I 
mean, for example, the State of Tennessee has created a review 
panel of physicians that can look at cases and can override aspects 
of HIPAA if that panel, and it is an objective panel 

Ms. DeGette. Right. 

Dr. Martini [continuing]. Decides that this particular situation 
is worthy of that, and I think those kinds of initiatives where 
HIPAA is seen as not simply a government regulation 

Ms. DeGette. Mandate. Yes. 

Dr. Martini [continuing]. But as a process, as something that 
they can participate in, I think the outcome would be better. 

Ms. DeGette. I agree with that, and if we still have our HHS 
witnesses here, yes, we do, some of them, is I think we should also 
have our federal agencies work with the colleges because a lot of 
these problems seem to come with the colleges trying to balance 
the important privacy protections for their students and also let- 
ting parents know. And, again, I think they would have some lee- 
way, but we would have to work with them to let them know that. 

Dr. Martini. I think it is a very good point. 

Ms. DeGette. OK. 

Dr. Martini. I think there would also need to be some help for 
them because coordinating mental healthcare for students some 
thousands of miles away would be a challenge. 

Ms. DeGette. And this goes to my — the last thing I want to talk 
about because it is not just the HIPAA issues. It is also access to 
treatment, and I think some of you have probably seen this in your 
communities. I had — I was actually at the eye doctor, and the as- 
sistant came in, and she said she had a 19-year-old son diagnosed 
with bipolar, and he had become violent. He was — he actually put 
himself into a 72-hour hold and then he was released, and he actu- 
ally, you know, involved his parents, and they were involved with 
it. They couldn’t find any mental health treatment for this kid in 
Denver, Colorado, and this is another issue as well is, you know, 
once you diagnosis this, you have got to be able to find treatment. 
I think. Doctor, you probably agree with that. 

Dr. Martini. Absolutely. I think work force is a big issue, cer- 
tainly in pediatric mental health services 

Ms. DeGette. Yes. 

Dr. Martini [continuing]. And also I think, I kind of alluded to 
this a little bit, we also need to work on access through primary 
care. I mean, the thing to remember is that a majority of the men- 
tal health problems are actually treated by local physicians in the 
community, and we need to work with them, we need to help them, 
we need to educate them so that access begins locally. 

Ms. DeGette. Thank you. Thank you, Mr. Chairman. 

Mr. Murphy. Thank you. I now recognize the gentleman from 
Virginia, Mr. Griffith, for 5 minutes. 

Mr. Griffith. Thank you, Mr. Chairman. I appreciate your pa- 
tience. 

Let me follow up on that. I think. Dr. Martini, you were talking 
about local health professionals being involved and trying to make 
sure people get treatment. Is it your opinion or what are your 
thoughts, can HIPAA also stand in the way of proper communica- 
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tions between, for example, the treating mental health professional 
and a patient’s general care physician? 

Dr. Martini. I think that there have been cases that I have 
worked on where the family, the patient, does not want the local 
physician to know about the extent of the psychiatric problems in 
part because the local physician is in the community, knows a 
great many people. I think that a good bit of that anxiety is mis- 
placed on the part of the patient, but I can understand it. I also 
think that what we need to do is we need to work with these local 
clinicians and physicians to involve them more in mental 
healthcare to educate them to make them part of the mental health 
system so that families recognize that the help that they provide 
is going to be in the patient’s and the family’s best interest. 

Mr. Griffith. Because one of my concerns that we heard from 
a previous hearing was it takes — or informal hearing but it took 18 
months for the average person with a mental health problem to, 
you know, get to see a mental health professional, and that is of 
concern and something that we need to address, but it would seem 
to me that your primary care physician might be in a position to 
shorten that time period just by making the referrals or by saying 
this is not such a big deal, and when it is a trusted family physi- 
cian, a lot of times they can be helpful in that regard. 

Also in following up, if the professional is not in the immediate 
community, I represent a rural area, so the mental health profes- 
sional may be, you know, the next community over, 30, 40, 50, 60 
miles, maybe more, and if they can then communicate with the 
local healthcare provider, it does create some benefits there. 

From the perspective of the patient, why do you think such com- 
munication, free communication between the healthcare providers 
is important? 

Dr. Martini. I think that on the part of the patient what it will 
allow them to do as you were pointing out is receive services, I 
think, more efficiently. I think that the local practitioners under- 
stand the community, understand what is available in the commu- 
nity, what is available not simply from the standpoint of medical 
services and mental health services but also within the community, 
within schools. They are familiar with that. I think that our — what 
we need to do as mental health professionals is we need to work 
with them to teach them what they can do, to get them comfortable 
with what they can do in their practices, and also to teach them 
when they can, when they should refer to us, and then as part of 
that we need to be available. We need to make ourselves available, 
and that is a big question. We do need to increase the size of our 
workforce but also we need to do this in a much more efficient and 
effective way. 

Mr. Griffith. Thank you very much. 

Ms. McGraw, I noted in your testimony that the fear of liability 
for violating HIPAA’s provisions coupled with misunderstanding of 
its provisions can be a recipe for not sharing. 

Ms. McGraw. Yes. 

Mr. Griffith. And I am just wondering if you are familiar with 
and I hate to ask Ms. Thomas, but I would ask, are you familiar 
with suits that go the other way, where permission could have been 
granted. I mean, in Ms. Thomas’s case, you know, the police asked 
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to be notified, he clearly — the police had made a determination he 
was dangerous to the community, they didn’t want him out of on 
the streets, the hospital then used HIPAA as a shield to say, oh, 
well, we couldn’t tell the police anything. 

So I am just wondering if you, Ms. McGraw, have heard of any 
suits, and Ms. Thomas, did you all even consider suing them for 
letting this dangerous person back out on the streets when HIPAA 
would have allowed it? 

Ms. McGraw. So I can tell you that HIPAA does not actually 
have any provisions that enable anyone to sue on enforcement of 
it. So either a patient in terms of privacy rights or someone else 
in terms of sort of over-interpretation. Keep in mind also that 
HIPAA’s allowance of disclosures for these reasons that we have 
talked about is permissive. It still relies on the judgment of 
healthcare providers to make the judgment call about what is in 
the best interest of the patient. 

Having said that, we need to keep in mind that HIPAA’s the 
floor and that there are State laws that may provide greater pro- 
tections, and they may medical privacy statutes that could be used 
for — to impose liability in those circumstances. 

But I certainly have never heard of anybody being sued for not 
releasing information except in the case of information that a pa- 
tient asks for that is about them, because you are required under 
HIPAA to disclose that information. You can be held accountable 
under HIPAA for not doing so. 

Mr. Griffith. I guess my concern that, and I was a practicing 
attorney for a lot of years, but my concern is that is one of the 
ways people like to hate lawyers, and I understand that, but that 
is one of the ways you sometimes get rectification in some of these 
cases, not that the money is important. It can’t bring anybody back, 
but it may keep somebody from making that mistake again. I 
mean, here we had an individual in your case, Ms. Thomas, who 
the police bring in, he has just run his car into the back of a ga- 
rage, he is clearly either a danger to himself or to others. They 
bring him in, they want psychological evaluation because he is a 
threat to somebody, and the hospital just lets him walk out even 
though the police ask for notification. I can’t think of anything else 
that would — and to me that is the classic definition of negligence, 
and I am very sorry. If you want to answer you can but 

Ms. Thomas. No. It is fine. It was considered as far as looking 
into a lawsuit, however, we were unable to get Mark’s records due 
to HIPAA, and we just decided that it probably wouldn’t be — it 
really wasn’t going to benefit anybody at that point in time to pro- 
ceed with a lawsuit. 

Mr. Griffith. And I respect that decision. 

Mr. Murphy. The gentleman’s time has expired. 

Mr. Griffith. Thank you. I appreciate it, Mr. Chairman, and I 
yield back. 

Mr. Murphy. Recognize Ms. Schakowsky for 5 minutes. 

Ms. Schakowsky. Thank you, Mr. Chairman. 

First of all, I just want to say that I hope in future hearings and 
other events that we will include testimony and participation from 
the patient community, and I know that there is some — I know 
there is a discussion right now 
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Mr. Murphy. Excuse me. 

Ms. SCHAKOWSKY [continuing]. About including testimony 

Mr. Murphy. We cannot — we are not permitted to have any out- 
bursts, and I would ask that members not say things that might 
also provoke some outburst. So I ask the folks be — just continue on. 
Go ahead, Ms. Schakowsky. 

Ms. Schakowsky. OK, and I know there is some discussion 
about including written testimony, highly footnoted, into the 
record, and I would certainly recommend that that be done without 
much ado. 

I wanted to — and let me thank especially the family members 
who came here with your stories. I know it has got to be very, very 
hard to do, and it is much appreciated. 

So I want to understand the examples that, a couple of examples 
that you gave. You had a patient, a former patient with a mild 
form of autism, and eventually his parents went to court against 
his wishes because they said their son could not care for himself 
and thus remained dependent, and you conclude, “Unfortunately, 
the subsequent ruling in their favor was counter to our goals of 
psychiatric treatment and derailed his progress in therapy.” 

So are you saying that that was a bad decision that the son 
should have been able to do what he wanted to do? 

Dr. Martini. No. What I was saying was that because the son 
would not allow his parents to be involved in his affairs, nor would 
he let them be involved in therapy, so I couldn’t incorporate them 
into any of the programming that I was trying to organize, any of 
the treatment that I was trying to organize, couldn’t involve them 
in the medications that he was prescribed, and they had serious 
concerns about how he was going to function. Because we couldn’t 
negotiate that, because he continued to refuse to allow them to par- 
ticipate, this was the only recourse that they had, it went counter 
to our therapy because the purpose of the therapy for me was to 
make him more functional, that my goal was 

Ms. Schakowsky. I understand that, but what would — at the 
point that you are saying if they had been involved earlier and I 
understand that, but at the point of someone making a decision, an 
adult making a decision about what they want to do, is there — I 
am trying to understand what a better outcome might have been 
and could it have been done without going — having to go to court. 

Dr. Martini. I think that is one of the reasons I put it in there 
is because I was searching for another way to have a better out- 
come without having to go to court. If there was a mechanism, for 
example, similar to the thing I mentioned in Tennessee where 
there was an opportunity to appeal or to present the case in front 
of a review board involved in HIPAA to say this is what is going 
on in this case, I think it is in this individual’s best interest to have 
the parents involved, to have them actively participate because I 
think it is more likely that this individual is going to be successful. 
His treatment is going to be successful, and his life, I think, is 
going to be less traumatized. If you have an opportunity to do that 
and there is a means to modify what is happening with the HIPAA 
regulations in these particular cases, I think that it would be an 
advantage not just for the family but also for the patient. 
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Ms. ScHAKOWSKY. So you asked the question, if there is a bias 
in these situations, should it be towards parental involvement rath- 
er than away from it. What do you conclude? 

Dr. Martini. Pardon me? 

Ms. ScHAKOWSKY. What do you conclude? If there is a bias in 
these situations, should it be toward parental involvement rather 
than away from it? 

Dr. Martini. I think that if there is a bias in the situation, you 
know, as a child and adolescent psychiatrist, my bias has been to 
involve families. We involve families as often as possible in treat- 
ments, and I think that for a variety of reasons, and I think if 
there is going to be a bias in that situation, my recommendation 
would be that it be toward family involvement, particularly if there 
are no specific reasons within that family, if there are no contra- 
indications within the family, nothing that would adversely affect 
the patient. 

Ms. ScHAKOWSKY. Just wonder, I mean, and I am not weighing 
in on either side, but I think there are people in the independent 
living community that would feel that a young adult with autism, 
that there may be some better ways for that individual to live in 
the community with support, help, et cetera, rather than as you 
used the word, dependent, at home. 

Do you see that as part of the negotiation that might involve ev- 
eryone? 

Dr. Martini. Absolutely. I mean, I think in this particular case 
the goal for this patient was greater independence. What the hope 
was in treatment was that he would be able to manage his affairs, 
that the level of anxiety that he felt in new situations would go 
down, that we would increase the capabilities that he had to man- 
age his medications. The sense was that having his parents in- 
volved, I think, would have expedited that process. 

Ms. ScHAKOWSKY. Thank you. I yield back. 

Mr. Murphy. Thank you. Recognize Ms. Ellmers for 5 minutes. 

Mrs. Ellmers. Thank you, Mr. Chairman, and I would also like 
to say to the panel, thank you so much — and I am going to get 
emotional — for coming and sharing your stories because this is the 
only way we are going to change anything in mental health. I know 
how difficult it is for you to come forward, but I can just say how 
much we appreciate your input so that we can make the right deci- 
sions moving forward. 

With that I would like to start, Ms. McGraw, thank you for your 
comments to my colleague. You know, one of the areas, as a nurse, 
and Ms. Levine, I completely I associate myself with your state- 
ments because I think sometimes it is easier to just give a blanket, 
hey, you don’t know what you are talking about. You are the family 
member. Anyone who knows better for your family is you. So, un- 
fortunately, that is one of the downfalls of nursing is sometimes we 
share our opinions a little too openly. 

But I am concerned about the misconception of lawsuits because 
as we know, there are so many frivolous malpractice lawsuits out 
there. This is one of those gray areas where healthcare profes- 
sionals do not feel that they are protected. Certainly HIPAA viola- 
tions can be weighed against them, but at the same time as far as 
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malpractice, that is not necessarily an avenue that will be taken. 
Am I correct with your testimony? 

Ms. McGraw. Yes. Well, certainly there is nothing in HIPAA 
that would enable someone to be sued. Again, to the extent that 
you have seen sort of any lawsuits in this space around privacy vio- 
lations, they are filed under state law provisions. 

Mrs. Ellmers. OK. 

Ms. McGraw. And I don’t do malpractice work, but, again, if you 
are being — if you are facing a malpractice lawsuit, that is a State 
law action. 

Mrs. Ellmers. Perfect. Thank you, and Mr. Wolfe, I would like 
to ask you a few questions. 

Mr. Wolfe. Thank you. 

Mrs. Ellmers. With your situation especially, and as sensitive as 
it is, again I thank you for being brave and sharing that with us. 
I read over your testimony to find that you were in a situation 
where you knew what was happening to your son, you knew that 
there was a drug addiction, and because of that behavior on his 
part with the manipulation that they do so well 

Mr. Wolfe. Right. 

Mrs. Ellmers [continuing]. He was able to manipulate and then 
kind of get his way. 

Mr. Wolfe. Yes. 

Mrs. Ellmers. And then you were able to get him into a treat- 
ment facility but then you were told that they could not share in- 
formation with you because of HIPAA. Correct? 

Mr. Wolfe. Exactly, and the manipulation, the lying that goes 
along with addiction from what I have learned from my son and 
from others since this has happened was just to give you one quick 
example, I wanted him to go into an inpatient treatment program 
immediately, and he said to me. Dad, I don’t want to go into an 
inpatient treatment because I don’t want to start using heroin or 
crack cocaine. And I as a parent had to make the decision what to 
do 

Mrs. Ellmers. Yes. 

Mr. Wolfe [continuing]. And I did my research and I did hear 
that people do smuggle in 

Mrs. Ellmers. Yes. 

Mr. Wolfe [continuing]. Heroin and crack cocaine, and there are 
a lot of other users than Percocet using, which is what he had indi- 
cated that he was doing to the family 

Mrs. Ellmers. Yes. 

Mr. Wolfe [continuing]. Not letting us know that he was doing 
heroin. So, therefore, the lies and manipulation unfortunately, we 
sent him to an outpatient which he said he would agree to go to, 
and when I tried to confront the outpatient counselor for the first 
couple of weeks I was denied any access to any records or be told 
why he was there. 

Mrs. Ellmers. You know that unfortunately is a story that we 
continue to hear, and I do agree with you. I do think that there 
are some changes that need to be made. More clarifications, I 
think, than anything so that both healthcare professionals, family 
members, and patients can all understand a little better what can 
be shared and what cannot. So I thank you. 
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Mr. Wolfe. Thank you. 

Mrs. Ellmers. Dr. Martini, I have just about 30 seconds left, but 
I do want to say just very recently I was at the Partnership for 
Children in Cumberland County, North Carolina, I represent in the 
second district of North Carolina. We had a lengthy discussion 
about mental illness, especially in relation to children. I have a 
very good friend whose son is autistic and now is starting to show 
signs of depression and some, beginning signs of mental illness. 
They are having an incredibly difficult time trying to find the cor- 
rect physician for him because of his autism that had already been 
diagnosed. 

Quickly, could you just say a few words about that? 

Dr. Martini. I think that the availability of services is a critical 
issue. I think at child and adolescent psychiatry we need to expand 
our workforce not just among psychiatrists but with all child and 
mental health professionals. I think we also, as I alluded to before, 
we need to work with community physicians. We need to work with 
schools. There are ways to provide services for children locally that 
can be efficient and effective beyond simply going to a tertiary cen- 
ter. 

Mrs. Ellmers. Thank you so much. I appreciate the Chairman 
giving me a few more seconds. Thank you. 

Mr. Murphy. The gentlelady’s time has expired. 

Mr. Scalise is next, but I understand he is going to allow Dr. 
Cassidy to go first. 

Dr. Cassidy, you are recognized for 5 minutes. 

Mr. Cassidy. Thank you, Mr. Chairman, and thank you, Mr. 
Scalise. 

Every one of you, thank you for your note of reality. 

Ms. McGraw, clearly we are all concerned about privacy and yet 
you can respect that there is a certain ambivalence that we must 
have or that is exhibited by this. So thank you all. 

Ms. Levine, the way that you said that the HIPAA laws should 
be written in something that a patient understands, I put excla- 
mation mark, exclamation mark, exclamation mark because it is 
written to avoid liability, not to inform people of what their rights 
are. 

Now, thank you, all. 

Dr. Martini, what a great name for a psychiatrist. 

Dr. Martini. I like it. 

Mr. Cassidy. I asked Mr. Rodriguez a question, and you put 
here, if you had a patient who was — if Lithium is still used for bi- 
polar, and if the level is declining but the patient is still com- 
pensated, would you feel that current HIPAA laws would allow you 
to speak to the parent of someone who is emancipated by age or 
by law that, listen, if this Lithium level goes any lower, they are 
going to have a psychotic break. This is not an immediate danger, 
but Mr. Rodriguez seemed to indicate that that would permissible. 
Would you accept that in your practice that is what most psychia- 
trists or whomever are doing? 

Dr. Martini. If the patient explicitly stated that he did not want 
that information shared if the patient was not in imminent danger 
to self or others, I think most psychiatrists would believe that they 
should not share that information. 
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Mr. Cassidy. Now, if the patient had a history of being non-com- 
pliant with Lithium and having bipolar episodes and creating some 
of these terrible heart-rendering stories occurring, would that 
change the calculus, or would it still be, no, we cannot do it? 

Dr. Martini. I think that what — when I talk to colleagues of 
mine about that situation, if they are dealing with a patient that 
they know is dangerous, if they are non-compliant with their medi- 
cations, they inform families and significant others, and they take 
the risk that they may be in violation of HIPAA because they be- 
lieve that it is in the best interest of the patient. 

Mr. Cassidy. Now, it is interesting because you say they take the 
risk, and yet that is a perception and yet some of what we have 
heard is that that should not be a risk. It should be kind of like, 
wow, don’t worry. It is not a risk, but it tells me that there is an 
ambiguity even among people who are full-time professionals. 
Would you accept that? 

Dr. Martini. Well, I think that that is true. I think that the 
problem is that it is that idea of waiting until imminent danger. 
A patient can be non-compliant on medication and for a period of 
time look pretty stable, and you know that eventually 

Mr. Cassidy. Now, not to be rude but we know that there are 
going to be a pattern of episodes, and so we know, man, he is off 
his Lithium. I see his level going down. Boom. It is going to happen 
again. Now, he doesn’t pull a gun, he doesn’t do anything terrible, 
but he does live under a bridge, he does leave his family, he does 
sell all his possessions and run down the street, whatever. 

In that would there be ambiguity among your colleagues whether 
they are at risk? 

Dr. Martini. I think that if when they are seeing the patient, if 
the patient appears stable and is doing well but they know they 
are non-compliant with the medications, understanding that mood 
disorders quite often are episodic, I think that there would be some 
concern if they told the family but they understand that in many 
situations they need to do that because the patient has a history. 

Mr. Cassidy. So, again, there is a perception they are running 
a risk? 

Dr. Martini. I think there is a perception that they are running 
a risk. 

Mr. Cassidy. Now, Ms. McGraw, Mr. Kelley used the term, I am 
not quite sure how to pronounce, but I think we are all familiar 
with it if we have a teenager. On the other hand, his is far more 
dramatic than that. A year of no insight. Now, this gentleman, his 
son said that his parents could not know his history, and yet he 
had no insight. We are not quite sure how to address that. What 
would you suggest? 

By the way, I was also struck as smart as you are and you are 
an expert in privacy, you learned something from Mr. Rodriguez’s 
testimony. I will tell you, an ER physician seeing 20 patients a 
night who is not in your specialty, not hearing this testimony, 
there is no way that ER physician, there is no way that she can 
actually be as facile with this information that we are demanding. 

What suggestions would you have as to regards of Mr. Kelley’s 
son? 
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Ms. McGraw. Well, one of the things that we have had a lot of 
conversation about and when I said that I learned something from 
Director Rodriguez this morning was how the concept of incapacity 
plays in the capability to share information with family members, 
which is not contingent on serious or imminent risk but cir- 
cumstances under which a mental health professional can make a 
judgment about talking to a family member when they believe it 
is in the best interest of the patient, which is in circumstances 
when the patient is not around to object or in incapacity. And in 
looking through the guidance that is right in front of me about the 
ability to talk to family members, the issue of this incapacity which 
is, in fact, in the regulatory language, it is not really explored in 
very much detail. 

So it does leave a lot of uncertainty on the part of providers 
about how they are — you know, how do they comply with that and 
what does that mean, and it certainly would be helpful to have the 
guidance explore that issue in a little more detail in my opinion. 

Mr. Cassidy. Thank you very much. I yield back, and thank you, 
again, Mr. Scalise. 

Mr. Murphy. Thank you. Mr. Scalise, you are now recognized for 
5 minutes. 

Mr. Scalise. Thank you. Thank you, Mr. Chairman, for having 
the hearing, and I especially want to thank those family members 
who have been impacted by mental illness for coming here and 
sharing your stories with us. We had I thought a real helpful forum 
back on March 5 where we had some other family members, includ- 
ing Pat Milan, who is from my district, whose son, Matthew, took 
his life, we being treated for mental illness. They, you know, they 
actually thought they were making progress. Both Pat and his wife, 
Debbie, were trying to get information from the doctor, from the 
treatment centers, and were not able to get that information, and 
HIPAA was being thrown up as the reason that they couldn’t get 
access. It turned out after the fact, unfortunately, after he took his 
life, that in his file he had actually authorized his parents to have 
access to information, and so it was just incredibly frustrating, an- 
gering, you know, for us hearing this at the forum that we had but 
especially to them as parents who were trying to get the right kind 
of help for their kids, for their son, and just couldn’t get that ac- 
cess. 

And so when we hear these stories, and I know, Ms. McGraw, 
you talked about it, Ms. Thomas, that people hiding behind HIPAA 
when it turns out that HIPAA really may not be the impediment. 
How do we get some clarity in HIPAA to remove this gray area, 
if it is even in fact gray, that is stopping vital information from 
being shared with family members, you know, and even in cases 
where these patients want their parents to have that access, and 
yet it is being denied. 

If, you know, anybody from Dr. Martini and maybe go across. If 
we can try to figure out what is this disconnect that is stopping 
this information from being shared when the law by many people’s 
own interpretation doesn’t preclude that information from being 
shared. 

Dr. Martini. I think the thing that is missing in these situations 
is a discussion of the clinical presentation and looking at these 
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cases on a much more individual basis and providing within the 
law some flexibility for whether it is appeal or whether it is in- 
volvement by clinicians so that there is an opportunity for a psy- 
chiatrist, a psychologist to present the case to an objective body to 
make a request for modifications in HIPAA in those particular situ- 
ations. 

Again, thinking about what is in the patients’ best interests and 
to have that objective body rule on that process I think somehow 
making it feel as though this is not simply the government telling 
people what to do, but it is the government giving people an oppor- 
tunity to protect their rights but also to ensure the patients get the 
best care possible. 

Mr. ScALiSE. Ms. Levine? 

Ms. Levine. I think we need to start with medical education, 
nursing education, and all other kinds of education to have objec- 
tive people presenting the rules of HIPAA, what is permissible, so 
forth, not the risk managers. I am sorry if anybody here is a risk 
manager, but I think this perception of the legal liability, yes, any- 
body can sue anybody for anything, but the real risk is in the secu- 
rity of the electronic data, and that seems to have been ignored in 
all of this HIPAA scare. The Washington Post did a 

Mr. SCALISE. And I apologize. I have only got a minute left, and 
I want to get to the four remainder 

Ms. Levine. Yes. So I think we need to do the education in an 
objective way, balanced way, and think about the patients’ best in- 
terests. 

Mr. ScALiSE. Thanks. Mr. Wolfe. 

Ms. Levine. Definitely include the family. 

Mr. Wolfe. Yes. I just want to say that I feel that the parents, 
it is very important for parents to be apprised of what is happening 
with their children, even when they are legally emancipated, and 
I think that is important to be put into because of the Obamacare 
since we do take care of them until the age of 26 under our insur- 
ance, I would not have lost Justin if I was made aware of what he 
was going in for. So I think the parents have to be made aware. 
We are the best caregivers with regard to our children, and there 
has to be an exception with regard to that. 

Mr. ScALiSE. Thanks. Mr. Kelley. 

Mr. Kelley. I would like to ask that the committee start expand- 
ing the definition of a family member beyond a parent because 
there are other members of the families that are in these roles, but 
quite frankly, change is hard, and I want to thank Ms. McGraw 
from the bottom of my heart because it is taken so long to hear 
what she just said. We need to change things, and sometimes you 
can’t get change unless you change things. There has got to be a 
carve out for the severely mentally ill or this unless the patient ob- 
jects clause will rule the world. 

Mr. ScALiSE. Thanks. Ms. Thomas. 

Ms. Thomas. I guess I would kind of agree with what he said. 
I think we need to be made more aware of what HIPAA actually 
does prohibit, and I do think there probably should be some special 
clauses there for the mentally ill. 

Mr. ScALiSE. Thanks. Ms. McGraw finally. 
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Ms. McGraw. Yes. Lots more guidance, clear, understandable, 
disseminated to places that people can easily find it, maybe in a 
hotline for questions. 

Mr. SCALISE. Thank you, Mr. Chairman. I yield back the balance 
of my time. 

Mr. Murphy. The gentleman’s time has expired. 

At this time we have finished the testimony. I understand that 
the Ranking Member has a unanimous consent request. I do want 
to say this. 

This committee has a practice of only accepting sworn testimony. 
We are going to be asked to accept a letter signed by a number of 
organizations which states in its first paragraph that they are sub- 
mitting a statement for the record in advance of the hearing. I 
want to say that we only became aware of this at 7:15 this morn- 
ing, and we have not had time to fully review this statement. In 
this case it is not a letter but as I said before, a “statement for the 
record,” which does not follow the tradition of this committee for 
sworn testimony. 

Moreover, this is a point of personal privilege for the Chairman. 
One of the groups who have signed this letter for the record has 
repeatedly circulated false statements about the Chairman and 
Ranking Member and have repeatedly and purposely misrepre- 
sented the serious and important work we are doing here on behalf 
of patients, families, healthcare providers, and the public. They 
have repeatedly and deliberately misrepresented the committee 
work with these false statements. 

Thus, in this case submitting a statement for the record without 
it being sworn testimony is of concern to the Chair, and I yield to 
the Ranking Member for her statement. 

Ms. DeCette. Thank you. Well, Mr. Chairman, I would ask 
unanimous consent to place a letter dated April 25, 2013, about the 
position of these organizations regarding HIPAA. It is signed by 
the American Civil Liberties Union, the Autistic Self-Advocacy Net- 
work, and the Baseline Center for Mental Health Law, and I would 
ask unanimous consent to put this in the record as the opinion of 
these organizations. 

As we have discussed before, I have been on this subcommittee 
now for 16 years, Mr. Chairman, and it has always been the prac- 
tice of the committee to take testimony under oath, and you are ab- 
solutely correct that this letter obviously is not under oath. It has 
also been the practice of this committee, though, to get extensive 
information from folks who might have expertise or opinions or oth- 
erwise, and I have seen this happen numerous times from both 
sides of the aisle. Simply accepting a document into the record does 
not necessarily imply agreement with the position stated in that 
document by either the Chair, the Ranking Member, or any other 
member but rather it helps to give a more full picture of what peo- 
ple think. 

But I agree with you. I do not consider this April 25 letter to be 
testimony or to substitute for testimony. I believe that it is a state- 
ment of that group, and we have done that. I have got many exam- 
ples here I could give, but in the interest of time I won’t. I simply 
ask for the Chair’s comity in putting this in and look forward to 
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working with you so that we can clarify documents that will be put 
in in the future. 

I would also note we also did put an article from Sports Illus- 
trated in the record today. So it seems to me this letter would be 
appropriate. 

Mr. Murphy. I thank the Ranking Member, and out of my re- 
spect for the Ranking Member and understanding some of the 
unique circumstances in this case, for the unanimous consent we 
will accept this into the record at this time. 

I do want to thank the panelists today in continuing our series 
to deal with this critically important issue for the American people. 
Not since John F. Kennedy was President I think have we had 
such a focus on the issues of mental health and mental illness in 
this country. 

Your statements today, the passionate statements from the fam- 
ily members, and, again, our sympathies and our prayers go out to 
you, the expertise, I)r. Martini, Ms. Levine, and Ms. McGraw, and 
those in our first panel, I ask that you stay in contact with us. We 
have a great deal of respect for what you have given to us today 
and look forward to working with you. 

I would like to also add this. I am very proud of the committee 
members on both sides of the aisle. I think that the members here 
have shown an absolute dedication to working on this. The state- 
ment we had earlier today, there is something like 38,000 suicides, 
700,000 emergency room admissions for people who have attempted 
harm to themselves, and all the issues involved. This committee is 
focused more than any other subcommittee I think in Congress in 
our memory and I deeply thank the Ranking Member for her com- 
passion and her passion in this. I also thank Mr. Braley for his 
bringing Ms. Thomas in today. 

Again, thank you all very much. I would like to say in conclusion 
that I remind members they have 10 business days to submit ques- 
tions to the record. I ask the witnesses to all agree to respond 
promptly to any questions we forward to them. 

With that this committee is adjourned. 

[Whereupon, at 11:35 a.m., the subcommittee was adjourned.] 

[Material submitted for inclusion in the record follows:] 

Prepared statement of Hon. Tim Murphy 

Last month, I convened a bipartisan forum to address a difficult, painful, and 
much-ignored topic: severe mental illness and violence. At our forum, Pat Milam 
told us about his son, Matthew, who had paranoid schizophrenia. For years. Matt 
suffered before taking his own life at just 22 years old. 

During that forum, Mr. Milam explained that his son’s doctors were unwilling to 
share concerns about Matt’s high risk of suicide. Mr. Milam believed that the inabil- 
ity to receive and discuss crucial information because of HIPAA was a contributing 
factor in his son’s death. Another witness, Liza Long, dreaded the difficulties she 
would face tr3dng to remain involved in her own mentally ill son’s care once he 
turns 18 due to privacy restrictions in HIPAA. 

I’ve been convening regular public forums in my district to discuss the state of 
our damaged mental health system. At each discussion, parents testified about the 
HIPAA-created challenges they experienced in getting the best care for their young- 
adult mentally ill children. As I have just mentioned, in some of these cases, the 
outcome was tragic. 

In 2002 my constituents, Charles and Debi Mahoney, lost their son. Chuck, to sui- 
cide. The warning signs were there. Chuck struggled with severe depression. His 
fraternity brothers, his ex-girlfriend, and college therapist all knew he was in dan- 
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ger and warned the college. But college administrators said federal privacy laws 
prevented the school from notifying Chuck’s parents about his condition. As the 
light was chased from this young man’s heart, those who were in a position to help 
did not. 

The stories of the Mahoney’s, the Milam’s, and those we will hear today compel 
us to act with care and compassion as we develop ways to overcome institutional 
barriers to quality mental health treatment. 

Ultimately, parents may be in the best position to help children suffering from 
significant mental illness by providing emotional support, medical history, and co- 
ordinating care with various mental health professionals. 

Today we will examine the ways in which federal privacy laws, beginning with 
whether HIPAA, applied properly or improperly, interferes with the quality of pa- 
tient care or compromises public safety or both. 

To be sure, HIPAA’s obstruction of health information-sharing between provider 
and family in no way is limited to mental health. Some of our witnesses will testify 
that a widespread misunderstanding of what HIPAA says can prevent individuals 
with serious long-term medical conditions from obtaining appropriate care. 

HIPAA, as initially conceived and enacted, reflected an effort to replace a patch- 
work of state laws and regulations impacting the confidentiality of medical informa- 
tion. From the start, HIPAA was accompanied by considerable anxiety on the part 
of providers, or the “covered entities.” Fearful of new penalties for violating HIPAA, 
doctors and nurses were refusing to even talk about a patient’s illness with care- 
takers, all of whom were caretakers, spouses, siblings, or those managing the affairs 
of their elderly parent. 

Unfortunately, “if you want to be safe, don’t tell anyone anything” became the 
prevailing attitude at the expense of the patient. 

HIPAA has implications that go beyond healthcare into the arena of public safety. 
According to data from the Government Accountability Office, the records of 1.5 mil- 
lion people who have been either involuntarily committed to mental health treat- 
ment, or deemed mentally incompetent by a court of law, and are therefore prohib- 
ited from owning a firearm, are missing from the National Instant Criminal Back- 
ground Check System, also known as NICS. 

Many states have said confusion over HIPAA has prohibited them from sharing 
these records with FBI and helping to keep firearms out of the hands of the vio- 
lently mentally ill. 

I’m encouraged that a letter sent by our committee in mid-February spurred the 
Department of Health and Human Services to announce last Friday plans to reform 
HIPAA so states could upload these records into NICS. I appreciate the work on 
this issue by HHS Office of Civil Rights Director Leon Rodriguez, who will testify 
here today. 

Our goal with this hearing is to peel away the numerous layers of misinformation 
surrounding HIPAA so that we can ensure patients are getting the right treatment 
and the public is kept safe. Sometimes this may involve communication with the 
parents or family of a patient, who often possess unique insight into their loved 
one’s condition. At other times it involves communication with law enforcement, so 
providers take the right steps to report threats of violence. 

To that end, we will be hearing first from Mr. Rodriguez and Mark Rothstein. Mr. 
Rothstein is a professor of law and medicine at the University of Louisville, and a 
noted expert on the HIPAA privacy rule. From 1999 to 2008, he served as chair of 
the statutory advisory committee to the Secretary of HHS on health information pol- 
icy. 

Next, we will hear from a panel of practitioners and family members who will 
comment on their personal experiences with HIPAA. Dr. Richard Martini is a Pro- 
fessor of Pediatrics and Psychiatry at the University of Utah School of Medicine. 
Carol Levine directs the United Hospital Fund’s Families and Health Care Project, 
which focuses on developing partnerships between healthcare professionals and fam- 
ily caregivers. 

I want to especially thank the family members who are here today — Gregg Wolfe, 
Ed Kelley, and Jan Thomas. Gregg’s son, Justin, who was diagnosed with a mental 
illness and had a substance addiction, died of a heroin overdose last December. Ed’s 
son, Jon Paul, has had severe mental illness for the last 14 years. These fathers’ 
efforts to obtain the best possible treatment for their sons was repeatedly stymied, 
in no small part due to misinterpretations of HIPAA by those responsible for their 
care. Jan’s husband, Ed, a beloved high school football coach, was murdered in 2009 
by a young man with mental illness. The parents of her husband’s killer believe that 
they were frustrated by HIPAA in trying to understand the full extent of their son’s 
paranoid schizophrenia. To Gregg and Jan, I want to extend our deepest sym- 
pathies. 
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We also have with us today Deven McGraw, Director of the Health Privacy 
Project at the Center for Democracy and Technology. This is an important subject, 
and I look forward to exploring this issue with my fellow subcommittee members 
at this hearing. 


# # # 


Prepared statement of Hon. Steve Scalise 

Mr. Chairman, families across America are grieving and searching for answers 
about why America’s mental health system has failed them and how it can be fixed. 
At the center of this investigation is a focus on the Health Insurance Portability and 
Accountability Act, otherwise known as HIPAA, which was passed more than fifteen 
years ago in an effort to promote patient privacy through the protection of health 
information and records. HIPAA has been highlighted as the source of many com- 
munication issues and roadblocks between patients, providers, and parental guard- 
ians. I will be submitting a series of questions for the record on behalf of my con- 
stituents, Pat and Debbie Milam, who tragically lost their son Mathew and experi- 
enced many obstacles within the mental health system. Mr. Chairman, I am com- 
mitted to helping the Milams and other families in similarly frustrating situations 
get to the bottom of these systemic failures in America’s mental health system. I 
appreciate your interest and look forward to continuing to work with you on this 
important issue. 
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QUESTIONS FOR THE RECORD 

Leon Rodriguez, Director, Office for Civil Rights, U.S. Department of Health and Human 

Services 

“Does HIPAA Help or Hinder Patient Care and Public Safety?” 

April 26, 2013 

Committee on Enei^ and Commerce, Subcommittee on Oversight and Investigation, U.S. 

House of Representatives 

The Honorable Tim Murphy 

Question 1; 

In your prepared testimony, you wrote: “be assured that OCR’s enforcement efforts are 
not directed toward imposing penalties on health care providers who make good faith 
efforts to comply with the Privacy Rule with regard to communications with patients’ 
family members and friends.” What will yonr office do, after this hearing, to make sure 
this is more widely known? 

OCR's focus is on systemic security problems and longstanding failures of certain entities to 
fulfill individuals’ rights under the Privacy Rule. The resolution agreements that OCR has 
entered into, as well as the single civil money penalty that we have imposed, demonstrate these 
priorities. 

To assist providers in understanding the law and our enforcement, our outreach efforts include 
posting a plain language guide for health care providers on communicating with patients’ family 
members, friends, or others involved in their care, and providing a searchable set of frequently 
asked questions about this topic and more. 

OCR also posts a significant amount of information about our enforcement activities on our 
website,' which includes pages dedicated to enforcement statistics, case summaries, and detailed 
information about cases that have been resolved informally — through demonstrated corrective 
action or with a corrective action plan and settlement amount paid by a covered entity — or that 
have resulted in a formal enforcement action against a covered entity. 

In addition, we regularly announce and emphasize our enforcement priorities through our many 
public speaking engagements at conferences and webinars directed to the regulated 
community .Question 2: 

As a general matter, how much discretion is left up to OCR in deciding whether to pursue 
penalties and corrective measures against a covered entity at all? What types of HIPAA 
privacy rule complaints are most likely to result in OCR taking corrective measures or 
imposing penalties? What guides OCR’s discretion? What factors does OCR consider? 


* httoi/Avwtv.hhs.eov/ocr/Drivacv/hiDaa/enforcemenl/index.hlml 


1 



119 


The statute requires the Secretary to impose civil money penalties whenever the Department 
makes a formal determination that a violation has occurred, and to formally investigate those 
cases where our preliminary review indicates a possible violation due to willful neglect. 
Otherwise, the Office for Civil Rights (OCR), acting on behalf of the Secretary, retains 
discretion with respect to accepting cases for investigation or review, and resolving these matters 
informally with the covered entity, most often through the demonstrated corrective action of the 
entity to come into compliance. The regulatory provisions relating to HIPAA enforcement are 
found at 45 CFR Part 160, Subparts C, D, and E. 

In the vast majority of cases, the covered entity will, through voluntary' cooperation and 
corrective action, be able to demonstrate satisfactory compliance with its HIPAA privacy or 
security obligations. However, where we find indications of noncompliance due to willful 
neglect, or where the nature or scope of the noncompliance warrants additional enforcement 
action, OCR would pursue a resolution agreement with a payment of a settlement amount and an 
obligation to complete a corrective action plan, or would impose a civil money penalty. In 
addition to indications of noncompliance due to willful neglect, when deciding whether to enter 
into a resolution agreement with, or proceed to formal enforcement against, a covered entity, 
OCR would consider factors including whether the entity’s noncompliance affected a very large 
number of individuals or resulted in demonstrated financial, physical, or reputational harm to 
individuals; whether the entity was noncompliant over a prolonged period of time or had failed 
to comply with multiple requirements of the Privacy or Security Rules; and whether the entity 
had a history of noncompliance or had failed to implement effective corrective aetions in prior 
informal resolution oases. 

The ultimate goal of our enforcement efforts is to protect the privacy rights of all individuals 
under the HIPAA Privacy and Security Rules through compliance by covered entities and 
business associates. Strategic use of our civil money penalty authority and high-profile 
resolution agreement cases draw attention to longstanding, systemic failures to comply with 
security or privacy requirements and raise the awareness of all covered entities and business 
associates of their obligations in these areas. 

Question 3: 

Are you concerned that the increased penalties for HIPAA privacy rule noncompliance 
that recently went into effect pursuant to the HITECH Act will make covered entities even 
more hesitant than before to share protected health information? Why or why not? Is OCR 
doing anything to address this preemptively? 

The purpose of higher penalties for HIPAA violations is to increase the incentive for covered 
entities and business associates to comply with their privacy and security obligations. 

Compliance involves knowing when and with whom the entity can share protected health 
information. As indicated above, we continue to educate covered entities and the public 
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regarding the ability of health care providers to share information with individuals’ friends, 
family members, and others involved in their care. 

Question 4: 

For which states does the HIPAA Privacy Rule prohibit state mental health facilities from 
submitting records for individuals who have been involuntarily committed or adjudicated 
as mentally defective to the National Instant Criminal Background Check System? 

On April 23, 2013, OCR issued an Advance Notice of Proposed Rulemaking (ANPRM) seeking 
comment from states and the public regarding barriers that HIPAA may pose to NICS reporting. 
Through this process, we hope to learn more about the nature and extent of any HIPAA barriers 
to reporting by the states. The comment period will end June 7, 2013. 

As described in Question 5 below, previously, the rule did pose challenges for a New York 
mental health agency. New York has since changed state law, and we understand that the 
HIPAA Privacy Rule no longer has that effect. 

Question 5: 

What is the nature or structure of those facilities that creates the conflict with the Privacy 
Rule? 

As mentioned in Question 4 above, OCR has issued an ANPRM for the purpose of learning more 
about the nature and extent of any HIPAA barriers to reporting by the states. 

It is our understanding that in the case of New York the state mental health agency is responsible 
for making information regarding individuals prohibited for mental health reasons from having 
access to a gun available to the Federal background check system. Because the mental health 
agency is a HlPAA-covered entity, it previously faced some challenges to reporting the records 
to the NICS. Ultimately, New York State passed a statute that requires the mental health agency 
to report this information to the NICS, making the disclosure permissible under HIPAA as a 
disclosure that is “required by law.” Thus, to our knowledge, HIPAA no longer prevents New 
York from reporting this type of information to the NICS. 

Question 6: 

What options do the parents of a young, mentally ill, adult have if: their child’s healthcare 
provider believes (perhaps falsely) that the HIPAA Privacy Rule prevents them from 
sharing information with the family, the child has refused to sign a release granting access 
to his health records to the parents, and a judge who has reviewed the case believes that the 
child has the right to refuse disclosure of his records because during a court appearance 
the child seemed to be of sound mind? Does HIPAA provide an exemption for such 
circumstances? 


3 



121 


A health care provider is permitted to disclose information to the family members of an adult 
patient who has capacity and indicates that he or she does not want the disclosure made, only to 
the extent that the provider perceives a serious and imminent threat to the health or safety of the 
individual or the public and the family members are in a position to lessen the threat. Otherwise, 
under HIPAA, the provider must respect the wishes of the adult individual who objects to the 
disclosure. However, HIPAA in no way prevents health care providers from listening to family 
members or other caregivers who may have concerns about the health and well-being of the 
individual, so the health care provider can factor that information into the individual’s care. 
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The Honorable Steve Scalise 


Question 1: 

What is the controlling factor to determine the age that a person gains Federal HIPAA 
rights? Is that governed by state or Federal law? Are there different standards and 
qualification ages for HIPAA in different states? 

HIPAA defers to state law to determine the age of majority and the rights of parents to act for a 
child in making health care decisions. Generally, parents or legal guardians are the persona! 
representatives of their unemancipated minor child and can exercise the HIPAA rights of the 
child, including access to his or her health care record. However, there are certain exceptions, 
such as when state law permits the minor child to receive care without the consent of a parent or 
guardian and the child chooses to do so. 

Question 2: 

How many different institutions and medical providers have been found in violation of 
Federal HIPAA laws over the past 5 years? What was the amount of the fines paid in the 
last 5 years? By how many violators? 

From 2008 through 2012, OCR obtained corrective action from covered entities in more than 
13,000 cases in which our investigations found indications of noncompliance with HIPAA. 

During the same period, OCR reached resolution agreements with covered entities in 1 1 cases. A 
resolution agreement is a contract between HHS and a covered entity or business associate in 
which the entity agrees to perform certain obligations, make reports to HHS, and, generally, pay 
a resolution amount to HHS. The payments resulting from these 1 1 resolution agreements total 
approximately $10 million. 

OCR has also imposed a civil monetary penalty of about $4 million in one case in which the 
covered entity failed for up to a year and a half to provide 41 individuals with access to their 
health information, as required by the HIPAA Privacy Rule, and failed to cooperate with OCR’s 
investigation. OCR found the covered entity had demonstrated willful neglect (the category of 
noncompliance for which the highest penalties may be assessed) in its failure to cooperate, when 
it refused to respond to OCR’s repeated demands to produce the records, failed to cooperate with 
OCR’s investigations of the complaints, and failed to produce the records in response to OCR’s 
subpoena, which ultimately led to a default judgment against the entity after OCR petitioned to 
enforce its subpoena in United States District Court. 
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More information about these cases, as well as other enforcement data and highlights, is 
available on OCR’s website." 

Question 3: 

If a potentially suicidal patient is released to an outpatient setting from a hospital or other 
institution, should the doctor be required to contact the outpatient medical provider? 
Would it be a violation of HIPAA if they did so? 

HIPAA permits a covered health care provider to disclose information about an individual to 
another health care provider without the patient’s authorization for treatment and coordination of 
care purposes, or to avert a serious and imminent threat where the second provider is in a 
position to lessen or avert the threat. The provider’s decision whether to make such a disclosure 
is guided by professional ethical standards and state laws governing the practice of medicine. 

Question 4: 

If a doctor deems an outpatient is at “high risk for suicide or other bad outcomes,” is it a 
violation of HIPAA for the medical provider to notify the parents or consult with family 
members with which the patient is living? Should the doctor be mandated to notify the 
other family members that the patient is a “high risk for suicide or other bad outcomes,” 
and what to watch out for at home? 

A health care provider’s “duty to warn” generally is derived from and defined by standards of 
ethical conduct and state laws and court decisions such as Tarasoff v. Regents of the University 
of California? HIPAA permits a covered health care provider to notify an individual’s family 
members of a serious and imminent threat to the health or safety of the individual or the public if 
those family members are in a position to lessen or avert the threat. Thus, to the extent that a 
provider determines that there is a serious and imminent threat of an individual committing 
suicide, HIPAA would permit the provider to warn the appropriate person(s) of the threat, 
consistent with his or her professional ethical obligations and state law requirements. In addition, 
even where danger is not imminent, a covered provider may always communicate with 
individuals’ family members, or others involved in the individual’s care, to be on watch or 
ensure compliance with medication regimens, as long as the patient does not object to the 
disclosure. 


^ httD://^^'^\w■hhs.20v/oc^/Dr^vacv/hiDaa/enforcement/index.html. 

^ httD://en.wikiDedia.ore/\viki/Regents of the University oF California . 
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The Honorable Bill Cassidy 


Questions 1 & 2: 

Has HHS issued guidance which clearly states how a physician should handle the privacy 
rule when their patient is in a state of psychosis or other form of mental incapacitation? If 
this guidance exists, does it take into account the fact that oftentimes, an individual’s 
disease influences them to reject the sharing of their health records, even if it is in their best 
interest? 

Does OCR plan to release sub-regulatory guidance to explain — in terms that apply to 
medical professionals — the instances in which an individual’s mental illness would 
constitute “incapacity”? If so, when can this guidance be expected and how will you ensure 
it reaches the provider level? 

Section 164.510(b)(3) of the HIPAA Privacy Rule permits covered entities, when an individual 
is not present or is unable to agree or object to a disclosure due to incapacity or emergency 
circumstances, to determine whether disclosing information to the individual’s family, friends, or 
others involved in the individual’s care, is in the best interests of the individual. 

OCR’s HIPAA guidance development efforts are an ongoing and continuous process, and we 
intend to address as part of these efforts the issue of incapacity with respect to individuals who 
have serious mental illness. OCR posts its guidance on its website as it becomes available and 
announces the availability of new guidance to covered entities, business associates, and the 
public through its listserv and at public speaking events. 

Question 3: 

Panelist Caroi Levine said that “ When family caregivers ask about their patient ’s care, 
they are routinely told ‘I can ’t tell you because of HIPAA. ’ This is not only contrary to the 
law; it is not good clinical care and jeopardizes the patient’s well-being. ” Is there a “pubiic 
friendly” federal government website that addresses these common misinterpretations and 
clarifies the Privacy Rule to which a family member in this situation could direct a 
physician or hospital administrator? If so, is there a strategy or effort to disseminate this 
information? 

OCR has both provider-focused and consumer-focused web-pages and plain-language guides on 
HIPAA and health care providers’ interactions with individuals’ family members and other care 
givers.'* The consumer guide* encourages individuals to take the guide and discuss it with their 
health care providers and family members and other caregivers. 


^ For example, http://mvw.hhs.gov/ocr/DrivacY/hiDaa/understanding/coveredentities/ provider ffg.pdf and 
http://mvw. hhs.gov /ocr/privacv.'hinaa/understanding/consumers/sharing-famiiv-friends.pdf. 

^ http://mvw.hhs.gov/Qcr/privacv/hipaa/understanding/consumers/consumer fTg.pdf. 
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In addition, our YouTube channel^ includes a video dedicated to this issue, which has been 
viewed more than 29,000 times. 

Question 4: 

I understand that mental health and addiction Electronic Health Records (EHRs) are being 
shut out of state and local Health Information Exchanges (HIEs) because of aggressive 
federal interpretations of HIPAA and 42 CFR Part 2. As far as I know, Kentucky and 
Rhode Island are the only state HIEs in the nation that actually share behavioral health 
EHRs. Can HHS promulgate sub-regulatory guidance that will permit the sharing of 
behavioral health EHRs without changes to HIPAA or Part 2? 

HIEs are quickly integrating into the healthcare landscape, enabling real time access to patient 
health information from multiple sources. However, most HIEs currently do not have the ability 
to exchange behavioral health information in compliance with certain state and Federal privacy 
and confidentiality laws (e.g., state mental health laws, 42 CFR Part 2). The Substance Abuse 
Confidentiality Regulations, 42 CFR Part 2, govern the use and disclosure of patient alcohol and 
drug abuse treatment records. These regulations establish detailed requirements for obtaining 
patient consent when sharing substance abuse treatment information. The exchange of behavioral 
health information within an HIE may be done in compliance with HIPAA without changes to 
the law. While it is possible for behavioral health information to be shared within an HIE 
without changes to Part 2, presently, most HIE systems do not have the capacity to manage the 
consents or to control the redisclosure of select types of information as required. 

HHS has sponsored several promising projects to advance the goal of sharing behavioral health 
information within an HIE. These projects include: the Data Segmentation for Privacy (DS4P) 
Initiative, which is focused on the creation of standards to allow sensitive health information to 
be shared in compliance with confidentiality laws and regulations; a project, sponsored by the 
Substance Abuse and Mental Health Services Administration, funding five state health 
information exchanges (HIEs) to develop local consent policies and a common consent form 
compliant with 42 CFR Part 2; and an ONC-funded Behavioral Health Data Exchange 
Consortium, created to pilot the exchange of behavioral health medical records between 
providers in different states using the Nationwide Health Information Direct protocols. 
Additionally, through a Program Information Notice published on March, 22, 2012, ONC has 
already provided program guidance to state HIEs focused on assuring secure, trusted health 
information exchange. This guidance addresses issues related to individual choice, including 
offering meaningful choice and meeting the requirements of existing law. When considering the 
challenges of exchanging behavioral health information, it is important to also remember that 
state laws play a critical role. In particular, HIPAA only sets a Federal floor for privacy 
protections, and more stringent state laws may provide greater protections to sensitive health 


‘ htlp:/A\'w'\v.vQutube.coni/user/USGovHHSOCR?feature=chclk. 
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information and additional requirements for exchange that must be considered by state HlEs. 
ONC has ftmded work identifying and classifying these laws. 


Question 5: 

If is the current policy of the OCR, ONC, and SAMHSA to require a patient to sign a new 
consent form every time a new provider joins a Health Information Exchange? In cases of 
serious mental illness, this is often not a practical expectation. Would HHS support, and 
issue guidance, that would permit a patient to opt-in or opt-out of sharing their mental 
health or addition Electronic Health Records (ElERs) in Health Information Exchanges 
(HIEs) without requiring the patient to sign a new form every time a new provider Joins the 
HIE? 

A number of laws, both Federal and state, apply to the sharing of health records related to mental 
health and substance abuse treatment, including 42 CFR Part 2, which specifically relates to 
Federally-funded substance abuse treatment programs. Patient consent under 42 CFR Part 2 is 
meant to be informed, a key factor of which is the ability of the patient to know and understand - 
at the time of providing consent - precisely to whom he or she is giving authorization for access. 
Because it is impossible to anticipate future providers who may join an exchange, and equally 
impossible to predict future concerns a patient may have regarding his or her health record, 
permitting a patient to opt-in or opt-out indefinitely of having substance abuse treatment records 
included in an exchange may violate these important informed consent principles. SAMHSA has 
published two sets of frequently asked questions addressing consent and other issues.’ 


'' Available at hKD://vi:'\vw.sairihs3.E0v4iealthPrivacv/docs/EHR-FA0s.pdf and 
httD:/M'\vw.samhsa.eov/about/jaws/SAMHSA 42CFRPART2FAOn Revised.pdf . 
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The Honorable G. K. Butterfield 


Question 1: 

It is my understanding that health care providers covered by the HIPAA “Privacy Rule”, 
must notify patients if the privacy of their health information is breached. What methods 
are used to notify those individuals? How does the Office for Civil Rights (OCR) ensure 
that health care providers are complying with the HIPAA “Privacy Rule”? What steps can 
individuals take if their health care record privacy has been compromised? 

Covered entities must notify affected individuals of a breach of their unsecured protected health 
information without unreasonable delay and in no case later than 60 days following discovery of 
the breach. Covered entities must provide this individual notice in written form by first-class 
mail, or alternatively, by e-mail if the affected individual has agreed to receive such notices 
electronically. The individual notification must include, to the extent possible, a description of 
the breach, a description of the types of information that were involved in the breach, the steps 
affected individuals should take to protect themselves from potential harm, a brief description of 
what the covered entity is doing to investigate the breach, mitigate the harm, and prevent further 
breaches, as well as contact information for the covered entity. 

For breaches affecting more than 500 residents of a state or jurisdiction, HIPAA also requires a 
covered entity to notify prominent media within the state or Jurisdiction. 

In addition to notifying affected individuals and the media (where appropriate), covered entities 
must notify the Secretary of breaches of unsecured protected health information by visiting the 
HHS website and filling out and electronically submitting a breach report form. OCR reviews 
and verifies the breach reports received, and, where appropriate, investigates underlying 
compliance issues that may have contributed to the breach and whether breach notification 
requirements were complied with. In accordance with a HITECH Act requirement, OCR posts 
information on our website about all breaches affecting 500 or more individuals. This informs 
the public and covered entities of specific instances of significant breaches and highlights 
organizational vulnerabilities that may lead to breaches of information. 

Individuals may submit complaints for investigation by OCR if they are concerned that their 
health information has been impermissibly accessed or misused. In addition, the Federal Trade 
Commission (FTC) has information on its identity theft web pages about actions that individuals 
can take if they believe fraud was committed with their information.* 

Question 2: 


° http://m\'\v.consumer.ftc.eov/articles/0326-niedical-id-theft-health-information-older-Deople . 
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If a patient objects to sharing information with certain family members or friends, is the 
provider able to communicate that request to other providers who may also treat the 
patient? 

Providers within the same legal entity or treatment setting are able to communicate regarding a 
patient’s wishes in this regard, to ensure compliance by the covered entity with those wishes and 
thus, the Privacy Rule. With respect to other providers who may treat the patient, it is the right 
of the individual to agree or object to these other providers sharing information with his or her 
friends and family members. 
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The Honorable John D. Dineell 


Question 1: 

Does current law prohibit people who are involuntarily committed to a mental institution 
or otherwise formally adjudicated as having a serious mental condition from owning a 
firearm? 

The Gun Control Act of 1968, Pub. L. 90-618, as amended, prohibits persons who have been 
committed to a mental institution, and individuals adjudicated by a court, board, commission, or 
other lawful authority as having a serious mental condition that causes them to pose a danger to 
themselves or others or renders them incapable of managing their own affairs, from shipping, 
transporting, receiving, or possessing firearms or ammunition. 

The regulation, at 27 CFR 478.1 1, defines “committed to a mental institution” as: A formal 
commitment of a person to a mental institution by a court, board, commission, or other lawful 
authority. The term includes a commitment to a mental institution involuntarily, commitment for 
mental defectiveness or mental illness, as well as commitments for other reasons, such as for 
drug use. The term does not include a person in a mental institution for observation or a 
voluntary admission to a mental institution. 

Question 2: 

Are states required to upioad mentai health records into NICS so individuals who are 
prohibited from owning a firearm do not have access to them? 

As with all of the categories of prohibited persons under the Gun Control Act, states can but are 
not required to make available to the NICS the identifying information for people prohibited 
from possessing a firearm for certain mental health reasons. Federal law encourages state 
reporting through various incentives, and some states have statutes requiring certain entities 
within the state to make this information available to the NICS. 

It is important to note, however, that the NICS never has mental health records. States report 
only the names of ineligible individuals (among those prohibited are individuals who have been 
committed to a mental institution and individuals adjudicated by a court, board, commission, or 
other lawful authority as having a serious mental condition that causes them to pose a danger to 
themselves or others or being incapable of managing their own affairs) and certain other 
identifying information, such as their dates of birth, as well as codes identifying the submitting 
entity and the prohibited category that applies to the individual. The NICS system never 
includes information on diagnosis, treatment, or other health records. 
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Question 3; 

Current law provides for an exception to the HIPAA privacy rule for certain law 
enforcement purposes. Do you believe this exception permits states to report mental health 
records to NICS? 

No. As described below, there are other provisions that may allow for the reporting to the NICS 
of identifying information for people prohibited from possessing a firearm for certain mental 
health reasons, but the HIPAA Privacy Rule’s law enforcement provisions (at 45 CFR 
164.512(f)) would not permit the disclosure because the purpose of the disclosure would not be 
related to a specific law enforcement inquiry. 

There are other Privacy Rule provisions that may apply and allow the disclosure, depending on 
the circumstances. Specifically, the Privacy Rule would allow the disclosure to the extent that a 
state has enacted a law requiring the disclosure. Alternatively, where there is no state law 
requiring reporting, the Privacy Rule would allow the disclosure to the extent the entity had 
designated itself a hybrid entity and separated its NICS reporting unit from its health care 
component(s), in which case the entity could report information through the non-HIPAA-covered 
NICS reporting unit which would not then be subject to disclosure restrictions under the Privacy 
Rule. 

On April 23, 2013, OCR issued an ANPRM seeking comment from states and the public 
regarding barriers that HIPAA may pose to NICS reporting. Through this process, we hope to 
learn more about the nature and extent of any HIPAA barriers to reporting by the states. The 
comment period will end on June 7, 2013. 

Question 4: 

Do you believe states need to pass their own laws to explicitly permit mental health 
reporting to NICS if the privacy rule is amended in the manner described in the Advanced 
Notice of Proposed Rulemaking? 

It is our understanding that some states have health information privacy restrictions in place that 
are more stringent than HIPAA. To the extent that is the case, if the Privacy Rule were changed 
to expressly permit certain covered entities to report identifying information about people 
prohibited from possessing a firearm for certain mental health reasons to the NICS under 
HIPAA, entities in some states still may face state law barriers to reporting such information. We 
hope to learn more from public feedback we receive in response to our Advance Notice of 
Proposed Rulemaking (ANPRM) on HIPAA and NICS reporting, in which we requested 
comments on any HIPAA and non-HIPAA barriers states face in reporting certain information to 
the NICS. The comment period will end June 7, 2013. 
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bu.siness on Tuesday. May 28, 2013. Your respon.ses should be c-mailed to the Legislative Clerk in Word 
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cc; Diana DcOcHic, Ranking Member, Subcommittee on Oversight and Investigations 


Attachment 



132 


Written testimony of Mark A. Rothstein 


The Honorable Tim Murphy 

1. In your testimony, you recommend that in order to advance health privacy and 
public health and safety, redrafting some of the public purpose exceptions to the privacy 
rule to make them more explicit would make sense. Can you please explain how your 
recommendation could be implemented? 

Several of the Privacy Rule's 12 public purpose exceptions, 45 C.F.R. § 164.512, do not 
provide adequate detail to apprise covered entities about the permissible uses and disclosures of 
protected health information (PHI). Perhaps the best example is the provision permitting uses 
and disclosures of PHI "to avert a serious threat to health or safety," which plays a central role in 
the disclosure of mental health information. The regulation, 45 C.F.R. § 164.512(j), provides, in 
pertinent part: 


(j) Standard: uses and disclosures to avert a serious 
threat to health or safety. 

(1) Permitted disclosures. A covered entity may, 
consistent with applicable law and standards of ethical 
conduct, use or disclose protected health information, if the 
covered entity, in good faith, believes the use or disclosure; 

(i)(A) Is necessary to prevent or lessen a serious and 
imminent threat to the health or safety of a person or the 
public; and 

(B) Is to a person or persons reasonably able to prevent 
or lessen the threat, including the target of the threat . . . 


This section of the Privacy Rule is related to the Tarasoff duty to warn imposed on 
mental health professionals. {Tarasoff v. Regents of the University of California, 55 1 P.2d 334 
(Cal. 1976))Yet, there is no single Tarasoff duty to warn, but 50 different jurisdiction-specific 
duties and various provisions contained in professional codes of ethics. According to the 
National Conference of State Legislatures, 29 states have laws mandating the reporting of serious 
threats, 16 states have permissive reporting laws, 4 states have no duty to report, and 1 state is 
listed as “other.” t www.ncsl.org/issues-research/health/mental-health-professionals-dutv-to- 
warn.aspx) Other provisions of state laws vary widely. For example, some states apply different 
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Written testimony of Mark A. Rothstein 

standards to different professionals (e.g., psychologists, social workers); other states differ on the 
circumstances when warnings are appropriate or vary in the individuals or entities that must be 
warned; and some states have immunity provisions if certain statutory requirements are 
followed. Consequently, the average person reading the applicable Privacy Rule provision would 
have no idea whether there was a privilege to breach confidentiality and/or a duty to warn 
without consulting a lawyer with special knowledge of the Privacy Rule and the particular state’s 
privacy and duty-to-wam laws. 

Even though it was not intended by either Congress in the HIPAA statute or the 
Department of Health and Human Services (HHS) in its rulemaking, the Privacy Rule has 
become the de facto legal standard for health privacy throughout the U.S. Accordingly, it is not 
good enough to have a series of broadly worded, “permissive” public purpose exceptions in the 
Privacy Rule. It is not good enough to say that disclosures are permitted, “consistent with 
applicable law and standards of ethical conduct,” when these other sources of disclosure 
obligations are often indecipherable. It is especially not good enough to have a vague and 
inconsistent legal standard applied to serious threats to public health or safety. A reasonable, 
uniform, national standard should be adopted and implemented. 

From a legal standpoint, achieving a national standard is a complex problem, but not an 
insoluble one. The Privacy Rule provision on averting a serious risk to health or safety, 45 
C.F.R. 164.512(j), combines two related issues. The first issue is raised explicitly by this part of 
the Privacy Rule: When is it permissible under the Privacy Rule for a health care provider to 
breach confidentiality and disclose PHI to avert a serious threat to health or safety? The second 
issue is raised implicitly by this section of the Privacy Rule: When does a health care provider 
have an affirmative duty to act to avert a serious threat to health or safety, the so-called “duty to 
warn”? The Privacy Rule’s lack of specificity and its policy of deferring to “applicable law and 
standards of ethical conduct” serve to conflate the issues of breaching confidentiality and duty to 
warn; it also mixes federal and state law with professional standards to create an unintelligible 
morass. Most tragically, because of this confusion some uninformed and risk-averse mental 
health care providers may be reluctant to invoke their privilege to breach confidentiality and to 
exercise their duty to warn. Such reticence could result in the failure to prevent a life-threatening 
situation. 
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A helpful way of analyzing the problem is to view the two issues (breaching 
confidentiality and duty to warn) separately — at least initially. For reasons of federalism. 
Congress may not want to enact legislation establishing a national standard for the duty to warn 
because it involves matters traditionally within the purview of the states. Similarly, because the 
statutory language in HIPAA only grants HHS limited regulatory powers, HHS would be unable 
to set a national standard for the duty to warn through rulemaking. Nonetheless, it is possible to 
achieve the goal of national uniformity for both breaching confidentiality and the duty to warn 
indirectly by utilizing existing federal legislation and a two-step process of harmonization. 

First, HHS clearly has the statutory authority to establish rules for when it is permissible 
under the Privacy Rule for a covered entity to breach confidentiality to avert a serious threat to 
health or safety. Indeed, HHS already has promulgated such a rule, 45 C.F.R. § 164.512(j), but it 
needs to be amended. After considering the views of all stakeholders, HHS should amend the 
current regulation and promulgate an explicit and detailed new regulation providing, for 
example, that when a psychotherapist or other provider of mental health services makes a 
reasonable determination that a patient or client constitutes a threat to cause death or serious 
harm to one’s self or another, the provider is permitted, under the Privacy Rule, to disclose PHI 
to law enforcement personnel, any intended victim or victims, or others who are in a position to 
avert the harm. HHS should delete the reference to “applicable law and standards of ethical 
conduct” because it is the source of inconsistency and confusion. 

Amendment of the HIPAA Privacy Rule should be accompanied by comprehensive 
guidance and specific examples. HHS also should work with professional associations, state and 
local governments, nongovernmental organizations, and consumer groups to provide meaningful 
notice and information about the amended regulation. The new, presumably more understandable 
and practical regulation would replace the current regulation. 

The second step would involve the states. As noted earlier, the amended regulation would 
not expressly address the issue of when a health care provider has an affirmative duty to warn. At 
least initially, the duty to warn w'ould remain a matter of state law, especially with regard to tort 
liability. Nevertheless, after a new Privacy Rule provision is promulgated with widespread input. 
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it is foreseeable that many states would move to harmonize their laws with a reasonable and 
uniform federal regulatory standard. State legislative initiatives to coordinate with the federal 
regulation are likely to receive strong support front mental health professionals, consumer 
groups, and the public, because having reasonable and uniform federal and state laws is not only 
easier for all affected individuals to understand, it is likely to prevent serious risks to safety and 
thereby save lives. 

At the same time the Privacy Rule is amended, all other federal laws and regulations 
dealing with the disclosure of mental health information and the duty to warn should be 
amended, as needed, to achieve consistency. Of particular importance is the Family Educational 
Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, and the implementing regulations issued 
by the Department of Education, 34 C.F.R. Part 99. FERPA applies to most public and private 
postsecondary institutions and to the health records of students at campus health clinics. The 
FERPA regulations provide: “An educational agency or institution may disclose personally 
identifiable information from an education record to appropriate parties, including parents of an 
eligible student, in connection with an emergency if knowledge of the information is necessary 
to protect the health or safety of the student or other individuals.” This permissive provision is 
broadly worded and, unlike the analogous HIPAA Privacy Rule provision, does not require a 
“serious and imminent threat.” [The issue of “imminent threat” is further discussed in the answer 
to Representative Cassidy’s question.] The divergence of the standards for disclosure of 
confidential information under FERPA and HIPAA further underscores the need for 
harmonization. 

As discussed in my testimony on April 26, 2013, individual health as well as public 
health and safety are advanced by maintaining strong protections for the privacy and 
confidentiality of mental health information. At the same time, for the small number of 
individuals with severe mental illness who constitute a serious threat to self or others, it is 
essential to have legal standards for health information disclosure that are reasonable, uniform, 
well understood, and consistently followed. Amending and clarifying the Privacy Rule is the first 
step in harmonizing federal and state disclosure laws. Coordinated federal and state efforts 
represent the best chance to reduce the risk of tragic violence while preserving the confidentiality 
upon which timely and effective mental health treatment depends. 
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The Honorable Bill Cassidy 

1. It seems to me that one of the biggest questions in a doctor's mind when dealing 
with a patient with a serious mental illness is whether a threat is not only serious, but also 
"imminent." As countless families have told ns, their children were seen by mental health 
professionals but they were released without information to the parent, seemingly because 
the doctor detected no imminent threat. Language, including regulations issued in regard 
to the NICS background check system, do not say "serious and imminent " threat, but only 
"serious threat." Knowing that HIPAA serves only as a floor for privacy laws (added onto 
by state laws, etc.), do you believe there would be a negative effect of removing the 
imminent requirement? 

The requirement of an imminent threat appears in the HIPAA Privacy Rule, 45 C.F.R. § 
]64.512(j)(l)(i)(A), which indicates when it is permissible for a covered entity to breach 
confidentiality and disclose PHI "to avert a serious threat to health or safety." HHS should 
amend the Privacy Rule to remove “imminent” from the regulation, because imminence is such a 
high standard that mental health providers might believe that even a deeply troubled and 
dangerous person did not expressly indicate that he or she was planning to take imminent action 
to harm themselves or others. Removing the “imminent” threat language in the Privacy Rule, 
however, would not resolve the underlying problem of inconsistent standards. 

Interestingly, the Tarasoff decision does not use the word "imminent" to describe the type 
of threat giving rise to a mental health provider’s duty to warn, but many state laws enacted after 
Tarasojf use this language. According to the National Conference of State Legislatures, 1 7 states 
and the District of Columbia require that, to establish a duty to warn, a threat must be 
“imminent” or “immediate.” The other states either do not limit the duty to warn based on the 
imminence of the threat or do not recognize any duty to warn. 


Professional codes of ethics do not require that a threat be imminent before mental health 
information should or may be disclosed. The American Medical Association (AMA) Code of 
Medical Ethics, § 5.05, which applies to all physicians and not merely psychiatrists, provides: 
“When a patient threatens to inflict serious physical harm to another person or to himself or 
herself and there is a reasonable probability that the patient may carry out the threat, the 
physician should take reasonable precautions for the protection of the intended victim, which 
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may include notification of law enforcement authorities.” Thus, according to the AMA, 
whenever there is a serious threat, a physician should take action. By contrast, the codes of ethics 
of mental health specialists are less proscriptive and stringent; they address only disclosure of 
mental health information and they make disclosure permissive. The American Psychological 
Association’s Ethical Principles of Psychologists and Code of Conduct § 4.05(b)(3) provides that 
disclosure of confidential information is permitted to “protect the client/patient, psychologist, or 
others from harm.” Similarly, the American Psychiatric Association's Principles of Medical 
Ethics, § 4, pt. 8, provides: “When, in the clinical judgment of the treating psychiatrist, the risk 
of danger is deemed to be significant, the psychiatrist may reveal confidential information 
disclosed by the patient.” 

Amending the Privacy Rule to remove the imminent threat requirement would permit a 
wider range of disclosures, but it would not establish a duty to warn. It also would create a 
conflict betw'een the amended Privacy Rule and 17 state laws. This situation further illustrates 
the importance of developing a uniform, national standard, as described in the answer to 
Chairman Murphy's question. 

The Honorable Bruce Bralev 

1. What have we learned from experiences as we move forward and try to create a 
balanced system that is protecting the public and rights of the patients to get the best 
possible treatment, when obviously we have been failing them? What can we do about 
that? 

Public policy on mental health treatment needs to pursue the following three objectives: 
(1) provide prompt, high quality, comprehensive, and continuing mental health treatment for all 
who need it; (2) maintain the confidentiality of mental health information disclosed within 
treatment, because without confidentiality many individuals needing mental health treatment will 
be deterred from seeking it; and (3) in the unusual situation where a mental health patient 
constitutes a serious threat to self or others, the mental health professional should understand it is 
not only permissible to breach confidentiality, but there is an affirmative duty to warn in 
accordance with a clearly articulated, well understood, reasonable, uniform, national standard. 
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The Honorable G.K. Butterfield 

1. Can you please describe how the new program of public and health care provider 
education and outreach suggested by the National Committee on Vital and Health Statistics 
could improve patient awareness of their rights to privacy? 

First, in the interest of flill disclosure, 1 was a member of the National Committee on 
Vital and Health Statistics (NCVHS) in 2002 when the recommendation for greater education 
and outreach was first made to the Secretary of HHS. 1 supported the committee 
recommendations then, and I believe the recommendations are even more important now. 

The HIPAA Privacy Rule has become largely irrelevant for a large percentage of patients. 
Under the Privacy Rule, patient consent is not required for uses and disclosures of PHI for 
treatment, payment, or health care operations. Instead, notice is required. Covered entities are 
required to provide individuals with a Notice of Privacy Practices, 45 C.F.R. § 164.520(a), and 
health care providers with a direct treatment relationship must make a good faith effort to obtain 
the individual's acknowledgement of receipt of the notice, 45 C.F.R. § 164.520(c)(2)(ii). In 
practice, the HIPAA notices are so long and detailed that patients typically do not read them if 
they are given them; sometimes individuals are asked to sign an acknowledgement that they 
received the notice when they never were given one, and in other instances they are asked to sign 
a statement saying they declined the offer of a notice. 

The current system of only sometimes providing patients with a Notice of Privacy 
Practices ~ and having patients who receive them rarely read and understand them — may do 
more harm than good by making it seem as if the HIPAA Privacy Rule is a meaningless 
paperwork requirement with little or no value to the individual patient. The typical patient’s 
unenlightening initial encounter with the Privacy Rule could be easily changed by requiring 
covered entities to provide patients with a one-page, clearly written summary of patient rights 
under the Privacy Rule, including such items as the right to view their health record, the right to 
copy their health record at no cost, the right to request restrictions on disclosures of their PHI, 
the right to opt-out of a hospital's directory, the right to file a complaint with the Office for Civil 
Rights, etc. Although these rights are now included in the detailed Notice of Privacy Practices, 
they are largely inaccessible to patients because of all the other provisions in the Notice of 
Privacy Practices. Patient rights are meaningless if patients do not know of their existence. 
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The Privacy Rule was not intended to be merely a set of regulations for disclosures of 
PHI in the payment chain of the health care industry. By default, it has become the nation's only 
broadly applicable health privacy law, and that means HHS has a significant responsibility to the 
public. This responsibility includes making a greater commitment to provide high quality public 
and professional education, such as producing on-line tutorials and training materials for health 
professionals and consumer-oriented health privacy materials in a variety of media. HHS also 
should establish a robust research program to assess the strengths, weaknesses, and effects of the 
Privacy Rule, which can be used to guide further amendments and clarifications. In 2003, the 
NCVHS recommended that HHS establish a program to conduct ongoing research on the Privacy 
Rule. (National Committee on Vital and Health Statistics, Letter to Secretary Tommy G. 
Thompson, June 25, 2003, www.ncvhs.hhs.gov/03062S 1 ShJ Ten years later, when the nation’s 
health care system is undergoing major changes, it is hard to understand why there has been no 
systematic effort to study the effects of the health privacy law applicable to the overwhelming 
majority of health care providers and patients in the nation. 
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Brittany Havens 
Legislative Clerk 

Committee on Energy and Commerce 
2125 Rayburn House Office Building 
Washington, D, C. 20515 

RE: Subcommittee on Oversight and Investigations 

Hearing "Does HIPAA Help or Hinder Patient Care and Public Safety?" 

Questions 

Ms. Havens: 

I included responses to the questions posed by Congressman Murphy and hope his concerns are 
adequately addressed in the content. Please let him know it is an honor and a pleasure to assist him in 
this process, and I am available should he have any additional questions or opportunities where I can be 
of service. 

1. Why do you think there are so many misconceptions about HIPAA? Do you think more training 
would help dispel the myths that many health workers have about the law? Whose 
responsibility is it to dispel these myths and clarify the privacy rule? 

The misconceptions about HIPAA are a product of the methods chosen by organizations to 
disseminate and enforce the regulations. The United States government makes information 
available to the public on websites and through a variety of announcements, but it Is large 
health care programs that interpret the material and work to apply it to routine practice. The 
individual clinician, whether in solo, group, or medical center based practices, frequently 
receives information about HIPAA through this filter. The intent of the regulations is well 
understood and supported by most if not all clinicians. However, the administration in local 
medical organizations tends to focus on the consequences of non-compliance, in part because 
of the substantial fines that can be imposed and the adverse publicity that results when 
violations are discovered. As a result, education programs tend to convey a message that HiPAA 
not only contains guidelines that are essential for patient privacy and confidentiality, but also 
that non-compliance risks substantial penalties for the organization and, both directly and 
indirectly, for the individual involved. The sense in efforts at communication and monitoring is 
"if we're in trouble, you're in trouble." As a result, clinicians see HIPAA as being imposed on 
them by large and powerful forces, with little or no opportunity for them to provide feedback or 
suggestions for change. There is minimal investment in carefully reviewing or critiquing the 
content for local or national organizations, and misconceptions of the law easily develop. 

The solution is not simply more training for more individuals, but a different approach to 
training, one that works to apply the law to a variety of clinical situations and conveys a message 
that enforcement is a work in progress. Physicians and a variety of medical professionals and 
organizations should continue to provide feedback through local HHS agencies on clinical 



142 


situations where the law adversely affects the best interests of the patient. Information can be 
shared in writing, through formal meetings, through the creation of webinars, and through a 
variety of electronic media. Clinicians can also enable families and caregivers who feel excluded 
by provisions of the law and less able to care and support loved ones to have a voice in the 
process. Although each patient's story is somewhat unique, there can be common threads that 
convey a powerful message on the potential risks and consequences of the law. Encouraging 
this dialogue enhances the skills of the clinician and educates government agencies on the 
practical application of HIPAA. It also empowers people to make necessary change. 

2. Do you have any thoughts on how well HHS has communicated with the health profession? Do 
you think HHS needs to dialogue more with doctors and professional associations? What would 
this dialogue look like. 

Responsibility begins with the Federal Government and HHS conveying a sense of greater 
openness and collaboration around the content and enforcement of HIPAA. It is then up to 
professional organizations in medicine, hospital administration, and clinical care to respond and 
encourage members to participate. These efforts can be national, local, or based within the 
operation of each clinical practice. The individual providing care can best advocate for the 
patient and the family, and shares an obligation to work in their best interests. 

The focus of communication by HHS is on an understanding of the law, why it is important, and 
how it will be applied. A great deai of information is available on government websites and in a 
variety of publications. However, the federal government has abdicated much of the 
responsibility for education to local patient care organizations, frequently university-based or 
corporate-based health care programs with large staffs who are at the greatest risk for a HIPAA 
violation. At times the intent of the law is lost in the need to conform to expectations for fear 
of consequences. HHS should have a more direct line to those individuals caring for debilitated 
and challenging patients and struggling to comply with HIPAA regulations. This should be an 
active and evolving process with HHS constantly reviewing the content and application of the 
law and recognizing that, as in health care, there is still much to learn. 

Sincerely, 

D. Richard Martini, M.D. 

Chief - Division of Behavioral Health 
Department of Pediatrics 

Chair - Department of Psychiatry and Behavioral Health 
Medical Director - Behavioral Health Services 
Primary Children's Medical Center 
Professor of Pediatrics and Psychiatry 
University of Utah School of Medicine 


Department of Psychiatry and Behavioral Health - Prim«y Children's Medical Center 
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100 N Mario Capecchi Dr 
Sait Lake City, Utah 84113 


Pediatric Behavior^tf Health 
Outpatient Clirvc 
675 E 500 S, Suite 300 
Salt Lake Oty. Utah 84012 


Wasatch Canyons Campus 
5770 S 1500 W, Bldg, 

S^ Lake City. Utah 84123 
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April 26. 2013. to icslify at the hearing entitled, ‘’Does HIPAA Help or Hinder Patient Care and Public 
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Pursuant to the Rules of the Cojnmittcc on Energy and Commerce, the hearing record remains 
open for ten business days to permit Members to submit additional questions for the record, which are 
attached. The format of yotir responses to these questions should be as follows: { 1 ) the name of the 
Member whose question you are addressing. (2) the complete te.xt of the question you are addressing in 
bold, atul (3) your answer to that question in plain text. 

1 0 facilitate the printing ofthc hearing record, please respond to these questions by the close of 
business on Tuesday, May 28. 2013. Your responses should be e-mailed to the Legislative Clerk in Word 
format at bnttanv.havens^"^mail. housc.gov and mailed to Brittany Havens, Legislative Clerk, 

Committee on F.ncrgy and Commerce. 2125 Rayburn House Oftlcc Building, Washington, D.C. 20515. 


Thank you again for yotir lime and effort preparing and delivering testimony before the 
Siibeommince. 


Sincerely, 



rim Murphy ^ 

Chairman 

Subcommittee on Oversight and Investigations 
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May 28, 2013 


Responses to Questions on the Record 
Hearing of April 26, 2013, entitled: 

“Does HIPAA Help or Hinder Patient Care and Public Safety" 

Subcommittee on Oversight and Investigations, Committee on Energy & Commerce 


Thank you again for the opportunity to testify at the hearing. I offer the following 
responses to questions for the record asked of me by Chairman Murphy and 
Representative Butterfield: 

The Honorable Tim Murphy 

1 . You have said that HIPAA has been “badly mangled.” What can be done to clarify 
the law? Do we need new legislative language? Do we need some clarification from 
the Office for Civil Rights? More public education? Please share with us your specific 
recommendations. 

The HIPAA Privacy Rule provides an important set of "guardrails” with respect to how 
health care providers and health plans can access and disclose sensitive a patient’s 
identifiable health information. However, the Rule also recognizes that routine access 
and sharing of health data is critical to patient care and public health. Consequently, 
the Rule expressly permits the sharing of patient data - without constraints - for a 
number of important purposes, including treatment, for public health reporting, and for 
certain law enforcement purposes. 

As I pointed out in both my written and oral testimony, the HIPAA Privacy Rule allows 
HIPAA covered entities (e.g., health care providers and health plans) to use or share 
information to avert a serious threat to health or safety.^ In addition, the Rule also 


' Specifically, a covered entity may, "consistent with applicable law and standards of ethical conduct, use 
or disclose protected health information if [it], in good faith, believes the use or disclosure is necessary to 
prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and [the 
use or disclosure] is to a person or persons reasonably able to prevent or lessen the threat, including the 
target of the threat.” 45 C.F.R, 512(j), Entities are expressly presumed to be acting in good faith if they 
are acting based on actual knowledge “or in reliance on a credible representation by a person with 
apparent knowledge or authority." 45 C.F.R, 512(j)(4). On January 15, 2013, the HHS Office for Civil 
Rights issued a two-page, to-the-point letter to health care providers alerting them to this exception, in the 
hope of dispelling widespread myths that HIPAA does not permit such disclosures. 
httD://www.hhs.aov/ocr/Drivacv/hiDaa/understandina/consumers/riQhttoaccessmemo.Ddf . 
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allows covered entities to share a patient’s information with someone who is involved in 
that patient’s care or who is paying for that care - such as a family member, relative or 
close personal friend - unless the patient has objected to such sharing.^ 

However, we know from the testimony shared by family members at the hearing, and I 
know anecdotally from my own experience, both as a patient and as the Director of the 
Health Privacy Project, that covered entities too often interpret HIPAA to prohibit sharing 
of patient information, even in circumstances where the regulations clearly allow such 
sharing. 

At the hearing, I used the term “badly mangled" to describe this over-interpretation of 
HIPAA, 

The regulators (at the federal level, the Office for Civil Rights; at the state level, a state 
Attorney General) have no authority to penalize such over-interpretation, even though it 
frequently has real consequences for patients and their families. The Privacy Rule 
expressly allows entities to share patient information in these circumstances, but it does 
not require them to do so. 

The HHS Office for Civil Rights has issued guidance on the provisions regarding 
sharing with family members, and that guidance is more clear and with less “legalese” 
than the regulatory text.^ However, I do not think most providers or patients know this 
guidance exists. In addition, the guidance could be more comprehensive, and cover 
“frequently asked questions" and offer responses to specific factual scenarios, so 
entities have a more clear picture of what they can - and cannot - do under the law. At 
the hearing, Leon Rodriguez, the Director of the Office for Civil Rights, addressed a 
number of questions about an entity's ability to disclose information to family members 
in the event of a patient’s “incapacity." The details he offered were more 
comprehensive than anything that I have seen in previous guidance on that aspect of 
the Rule. Those details should be part of more comprehensive information about the 
Rule that is more easily accessible and broadly disseminated to the provider and patient 
community. 

I suggest that the Office for Civil Rights develop and more broadly disseminate 
guidance on both of these provisions. With respect to the provisions permitting 
disclosures to family members, the Office should work with provider and patient 
and family organizations both respect to developing the content of this guidance 
and in ensuring it is broadly disseminated. 

Here’s another idea: The Office could establish a mechanism for gathering and 
affirmatively responding to compiaints about over-interpretation of the HIPAA Privacy 
Rule. Such over-interpretations are not violations of HIPAA, but the Office could 
nevertheless be part of the solution through timely advice to entities of disclosures that 
are permitted. The Office also could routinely blog about such complaints -and the 


^45C.F.R. 510(b). 

^ http://www.hhs.aov/ocr/Drivacv/hiDaa/understandina/coveredentitie5/provider ffg.Ddf . 
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proper interpretation of HIPAA in the circumstances in question - in a way that does not 
reveal the name of the entity in question as another mechanism for educating the 
public. 

These suggestions do not require legislative action. 

2. In your written statement you referenced a 2007 poll showing that 17 percent, or one 
in six adults, say they withhold information from their health providers due to worries 
about how the medical data may be disclosed. Are you aware of any studies that ask 
this question specifically with regard to the sharing of personal mental health 
information? 

The statistic from my written statement is from general survey data, and you are correct 
that it does not focus on mental health information. We appreciate the additional time to 
find studies specifically addressing concerns about confidentiality and mental health 
information. Not surprisingly, general surveys of persons with mental health disorders 
are difficult to find (and we suspect confidentiality concerns among this population may 
be a reason why such surveys are so rare). Nevertheless, we were able to locate 
additional research on mental health and the need for confidentiality, and links to that 
additional research are attached to this response. 

As further evidence of a widespread recognition of the need for confidentiality in mental 
health treatment, as of 2002 50 states (including the District of Columbia and excluding 
Arkansas) had specific statutes related to some aspect of mental health privacy.* Such 
privacy laws are not preempted by HIPAA if they provide stronger protections for mental 
health data. 


The Honorable G.K. Butterfield 

1 . Patients' rights to access psychotherapy notes are restricted more than other types 
of health records. Can you please explain what sort of access individuals have to that 
information? What happens if the patient believes the information to be inaccurate? 

As I noted in my written statement, the Privacy Rule provides additional protections for 
psychotherapy notes. The term “psychotherapy notes" is defined as the personal notes 


" Beckerman, J et al., "Health Information Privacy, Patient Safety, and Health Care Quality: Issues and 
challenges in the Context of Treatment for Mental Health and Substance Abuse," SNA's Health Care 
Policy Report, vol. 16, No. 2 (January 14, 2008). This article includes a comprehensive discussion of 
HIPAA’s provisions regarding “preemption.” 
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of a mental health professional taken during a counseling or therapy session. ® Entities 
covered by the Privacy Rule must obtain a specific, formal authorization from the patient 
in order to disclose psychotherapy notes in most circumstances (such notes can be 
used internally to treat the patient).® 

The right of patients under the HIPAA Privacy Rule to access and obtain a copy of their 
health information does QOt apply to psychotherapy notes.^ The Privacy Rule does 
provide patients with the right to request a correction to information in a provider's 
medical record; however, this right does Qot extend to information that the patient does 
not have the right to access.® As a result, it is unlikely that many patients would be 
provided with the ability to view their psychotherapy notes, and it would be solely in the 
discretion of the medical professional who created those notes (or the record holding 
institution) witti respect to whether any correction would be made. 


Respectfully submitted, 


□even McGraw 

Director, Health Privacy Project 


° Psychotherapy notes are “notes recorded (in any medium) by a health care provider who is a mental 
health professional documenting or analyzing the contents of conversation during a private counseling 
session or a group, joint or family counseling session and that are separated from the rest of the 
individual's medical record. The term ‘psychotherapy notes' excludes data relating to medication 
prescription and monitoring, counseling session starts and stop times, the modalities and frequencies of 
treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, 
functional status, the treatment plan, symptoms, prognosis, and progress to date." 45 C.F.R, 164,601. 

® 45 C.F.R, 164.508(a)(2). Such notes may be used by the originator in order to treat the patient; they 
also can be used for training purposes and to defend against a legal action or other proceeding. Id. Of 
note, the U.S. Supreme Court, in a case recognizing psychotherapist-patient privilege in federal rules of 
evidence, acknowledged the critical role that confidentiality of psychotherapy notes plays in mental health 
treatment: "Effective psychotherapy , . . depends upon an atmosphere of confidence and trust in which 
the patient is willing to make a frank and complete disclosure of facts, emotions, memories, and fears. 
Because of the sensitive nature of the problems for which individuals consult psychotherapists, disclosure 
of confidential communications made during counseling sessions may cause embarrassment or disgrace. 
For this reason the mere possibility of disclosure may impede development of the canfidential relationship 
necessary for successful treatment.' Jaffree v. Redmond, 518 U.S. 1 (1996). 

’ 45 C.F.R. 164.524(a)(1)(i), 

®45 CFR 154.526(a)(2)(i). 
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Privacy implications With Respect to Mental Health Treatment 

Confidentiality and Mental Health Treatment of Adolescents 

A critical element in privacy is the confidentiality between a patient and the health care 
provider and even more critically, how perceptions of confidentiality affect willingness to 
seek care or disclose symptoms/thoughts with the mental health professional. 

Professional societies promote confidentiality with adolescent patients, but have also 
recognized the importance of involving parents in serious healthcare events. 
Specifically, the Society for Adolescent Medicine has stated that, “confidential health 
care should be available, especially to encourage adolescents to seek healthcare for 
sensitive concerns ...” , and parental involvement should be encouraged, but not 
mandated. 

f http://www.adolescenthealth.ora/AM/Template.cfm?Section=Position Papers&Templat 
e=/CM/ContentDisplav.cfm&ContentlD=2597 ) 


Studies have found that adolescents are more willing to disclose highly personal 
information (including mental health information) to a physician after being given 
assurances of confidentiality. 

f http://iama. iamanetwork. com/article. aspx?articleid=41 8249 ) 

fhttp://iama.iamanetwork.com/article.aspx?articleid=195185 ) 

Underlining the importance of confidentiality in adolescent healthcare, an anonymous 
survey of 1295 Massachusetts high school students found that 25% reported that they 
would be willing to forgo health care in some situations if their parents might find out. 
(http://iama. iamanetwork. com/article.aspx?articleid=404397) 

Other studies have found similar results: 

(http://www.ncbi.nlm.nih.aov/pubmed/10447039 ) 

(http://www.ncbi.nlm.nih.aov/pubmed/12169074 ) 

Other works have shown that there are variances amongst health care providers 
willingness to discuss confidentiality with their adolescent patients or even to provide 
them with such confidentiality. 

(http://pediatrics.aappublications. ora/content/1 1 1/2/394. short) 

(http://archpedi. iamanetwork. com/article.aspx?articleid=51 8355) 


One study found that mental health professionals protect the confidentiality of older 
minor clients (16-18 years of age) to a greater extent than for younger minor clients (11- 
15 years of age). 
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“There are two factors that consistently mitigate decisions to breach 
confidentiality among mental health counselors in private practice and other 
employment settings. The first is age of the minor child, With greater autonomy to 
make individual decisions afforded older clients. The only exceptions were clear 
threats of violence with guns. While most authors agree that minors have similar 
rights to privacy as adults, the age of the minor seems to change counselors' 
prediction of how they would handle those rights." 

(httD://vww.biomedsearch.com/article/Confidentialitv-with-minors-mental- 

health/80553853.htmn 

Although not specifically related to mental health care, a survey, of high school 
counselors, found that they were more willing to break confidentiality when risky 
behaviors were “more intense, more frequent and of longer duration” and that there was 
variance with regards to the counselors willingness to break confidentiality when 
suicidal ideation was present, 

fhttD://sch oolcounselor.metapress.com/content/7873732816122842A 

Finally, ethical studies have found that “paternalism” (i.e. - disclosing adolescent health 
conditions with parents) was justified only in cases where protecting the adolescent’s 
life was the central goal. 

fhttp://www.ncbi.nlm.nih.aov/pubmed/26067471 


Confidentiality and Mental Health Treatment for Medical Students 

Surveys of depressed medical students have also found that lack of confidentiality is a 
barrier to seeking mental health treatment. 

(http://iournals.lww.eom/academicmedicine/Abstract/2002/09000/Depressed Medical S 
tudents Use of Mental Health. 24. aspx ) 
(http://w\ww.iQme.orQ/doi/abs/10.4300/JGME-D-09-00086.1 ) 


Stigma and Mental Health Treatment 

Another important policy topic related to the use of mental health services is perceived 
stigma attached with mental health illness, and the consequence for seeking mental 
health treatment can be, "...negative evaluations and rejection from others.” 
(https://wesfiles.weslevan.edu/courses/PSYC-309- 
clwilkinsAA/eek4/Sibickv.%20Dovidio. 1986.pdf ) 
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The academic literature has found that stigma can be an important barrier to seeking 
mental health treatment. 

( https://selfstiqma.psvch.iastate.edu/sites/selfstiama.psvch.iastate.edu/files/self%20stia 

ma%20mediation.pdfi 

f http://vvww.nebi.nlm.nih.aov/pubmed/1 5491256) 

Loss of social status was also cited by 62% of employees in one national survey as a 
barrier to seeking treatment. 

( http:/Avww.ibhi.net/emplovees-report-mixed-feelinqs-about-seekino-health-care- 

treatment/ ) 

One scientific study on the topic found that the perceived stigma associated with 
seeking mental health care among university students was inversely associated with 
seeing a need to seek such care (i e- - students had higher perceived stigma if they felt 
they did not need to seek care while students had lower stigma associated with seeking 
care if they felt they did need it,); while amongst students with probable depressive 
disorders, there was no evidence of perceived stigma effecting use of mental health 
services. 

(http://ps.psvchiatrvonline.ora/article.aspx?articlelD=99261) 

Another study from Germany found the following: 

“Contrary to expectations, anticipated discrimination from others was 
unrelated to help-seeking intentions, while personal discriminatory 
attitudes seem to hinder help-seeking ." 
( http://link.sprinqer.eom/article/10.10Q7/s00406-009-0870-v) 


And, a study from Australia found: 

“Seeking help from a [general practitioner) for psychological problems was 
predicted by having a positive attitude towards seeking psychological help 
... [c]ontrary to expectations, perceived stigma didn't influence help 
seeking.” 

( http://link.sprinqer.eom/article/10.1007%2Fs00127-006-0089-47LI-true ) 
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